Edit tour

Windows Analysis Report
test.exe

Overview

General Information

Sample name:	test.exe
Analysis ID:	1583646
MD5:	120aabd78079a8792013afb29779c425
SHA1:	4db0126a6007588c737ce8c9ecab63922c4f5882
SHA256:	824dd600dd22e7f2b0117eb54d88a5141e234f2d4cfbc5954a6b3dddeedc65e9
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Uses known network protocols on non-standard ports

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Classification

Process Tree

System is w10x64

test.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\test.exe" MD5: 120AABD78079A8792013AFB29779C425)

test.exe (PID: 7400 cmdline: "C:\Users\user\Desktop\test.exe" MD5: 120AABD78079A8792013AFB29779C425)

cleanup

Sigma Signatures

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 130.61.86.87, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Users\user\Desktop\test.exe, Initiated: true, ProcessId: 7400, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.4% probability

Source: C:\Users\user\Desktop\test.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: test.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: test.exe, 00000000.00000003.1665022871.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: test.exe, 00000000.00000003.1661033684.0000026251912000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: test.exe, 00000000.00000003.1663327681.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: test.exe, 00000000.00000003.1662688174.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: test.exe, 00000000.00000003.1663976148.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897297543.000001A602FD0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: test.exe, 00000000.00000003.1665091933.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: test.exe, 00000000.00000003.1663069892.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: test.exe, 00000000.00000003.1664105921.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: test.exe, 00000000.00000003.1662036446.0000026251914000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: test.exe, 00000000.00000003.1662036446.0000026251914000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: test.exe, 00000000.00000003.1662749478.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: test.exe, 00000000.00000003.1723876938.0000026251917000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: test.exe, 00000000.00000003.1663540336.0000026251916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: test.exe, 00000000.00000003.1660926673.0000026251912000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: test.exe, 00000000.00000003.1663667932.0000026251916000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: test.exe, 00000000.00000003.1663004612.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: test.exe, 00000000.00000003.1663476327.0000026251916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: test.exe, 00000000.00000003.1662623856.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: test.exe, 00000000.00000003.1664170530.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: _ctypes.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: test.exe, 00000000.00000003.1663258208.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: test.exe, 00000000.00000003.1664561081.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pdh.pdb source: test.exe, 00000000.00000003.1725089225.0000026251917000.00000004.00000020.00020000.00000000.sdmp, win32pdh.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: test.exe, 00000000.00000003.1662209701.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: test.exe, 00000000.00000003.1663390115.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: test.exe, 00000000.00000003.1664042926.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: test.exe, 00000000.00000003.1664955089.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: test.exe, 00000000.00000003.1662370578.0000026251915000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: test.exe, 00000000.00000003.1661435042.0000026251912000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: test.exe, 00000000.00000003.1661949696.0000026251914000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: test.exe, 00000000.00000003.1664432273.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: test.exe, 00000000.00000003.1665165455.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.0.dr

Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167092F0 FindFirstFileExW,FindClose,	0_2_00007FF7167092F0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167218E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7167218E4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167083B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7167083B0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167092F0 FindFirstFileExW,FindClose,	1_2_00007FF7167092F0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167218E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7167218E4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167083B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF7167083B0

Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\AppData\Roaming\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\Application Data\Microsoft\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\Application Data\	Jump to behavior

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49739

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 130.61.86.87:8888

Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87
Source: unknown	TCP traffic detected without corresponding DNS query: 130.61.86.87

Source: global traffic	HTTP traffic detected: GET /leo_uwu.jpg HTTP/1.1Host: 130.61.86.87:8888User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /silence.mp3 HTTP/1.1Host: 130.61.86.87:8888User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /example.zip HTTP/1.1Host: 130.61.86.87:8888User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive

Source: test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2902906834.000001A60B6E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://130.61.86.87:8888/example.zip
Source: test.exe, 00000001.00000002.2902906834.000001A60B6E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://130.61.86.87:8888/leo_uwu.jpg
Source: test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2902906834.000001A60B6E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://130.61.86.87:8888/silence.mp3
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: http://aggregate.ee.engr.uky.edu/MAGIC/#Population%20Count%20(Ones%20Count)
Source: test.exe, 00000001.00000002.2899346841.000001A604840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue23606)
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663976148.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251922000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662623856.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664042926.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663258208.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665091933.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663976148.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251922000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: test.exe, 00000001.00000002.2897432214.000001A6036B9000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861448295.000001A603720000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887987139.000001A603722000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: test.exe, 00000001.00000003.1738957157.000001A604020000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1738957157.000001A603FE1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: test.exe, 00000000.00000003.1718421236.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.d
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663069892.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663327681.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.co
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663976148.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251922000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662623856.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssur
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664042926.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663258208.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665091933.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: test.exe, 00000000.00000003.1662209701.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.cr
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: test.exe, 00000000.00000003.1722758543.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.dig
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA38
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665091933.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: test.exe, 00000000.00000003.1718421236.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A603FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail
Source: test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: test.exe, 00000001.00000002.2898571267.000001A604168000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604108000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/
Source: test.exe, 00000001.00000002.2898397083.000001A603FE0000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: test.exe, 00000001.00000002.2901737460.000001A60AB70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digi
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665091933.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663976148.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251922000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663976148.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251922000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662623856.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664042926.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663258208.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digif
Source: test.exe, 00000000.00000003.1718421236.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: test.exe, 00000001.00000002.2898032241.000001A603BB0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: test.exe, 00000000.00000003.1703075730.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: test.exe, 00000000.00000003.1703075730.0000026251924000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703075730.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703167825.0000026251924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665091933.0000026251923000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: test.exe, 00000000.00000003.1718421236.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.eclipse.org/0
Source: test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604394000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861381911.000001A604385000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/index.html
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: test.exe, 00000000.00000003.1721115939.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.math.sci.hiroshima-u.ac.jp/m-mat/MT/JUMP/
Source: test.exe, 00000000.00000003.1721235426.0000026251917000.00000004.00000020.00020000.00000000.sdmp, _pcg64.cp310-win_amd64.pyd.0.dr	String found in binary or memory: http://www.pcg-random.org/
Source: test.exe, 00000001.00000002.2897514642.000001A6037B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.scipy.org/not/real/data.txt
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.xyz.edu/data
Source: test.exe, 00000001.00000002.2898571267.000001A604168000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A603FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: _cffi_backend.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://data-apis.org/array-api/latest/design_topics/data_interchange.html#syntax-for-data-interchan
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://digitalassets.lib.berkeley.edu/sdtr/ucb/text/34.pdf
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dmlc.github.io/dlpack/latest/python_spec.html
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: test.exe, 00000001.00000003.1729864477.000001A601610000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/subprocess.html#popen-objects
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: test.exe, 00000001.00000002.2898571267.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/library/string.html#format-specification-mini-language
Source: test.exe, 00000001.00000002.2898571267.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.scipy.org/doc/numpy/user/basics.io.genfromtxt.html
Source: test.exe, 00000001.00000002.2901607773.000001A60AA60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.scipy.org/doc/numpy/user/numpy-for-matlab-users.html).
Source: test.exe, 00000001.00000002.2898571267.000001A6041C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doi.org/10.1109/IEEESTD.2008.4610935
Source: test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#colorchannelmixer
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#concat
Source: test.exe, 00000001.00000003.1741871596.000001A603B09000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861194264.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861430218.000001A603B92000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887968918.000001A603B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#crop
Source: test.exe, 00000001.00000002.2897735981.000001A6039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#drawbox
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#drawtext
Source: test.exe, 00000001.00000002.2899346841.000001A604840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#hflip
Source: test.exe, 00000001.00000002.2897432214.000001A6036B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#hue
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#overlay-1
Source: test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#setpts_002c-asetpts
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#trim
Source: test.exe, 00000001.00000002.2899346841.000001A604840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#vflip
Source: test.exe, 00000001.00000002.2897735981.000001A603A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg-filters.html#zoompan
Source: test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg.html#Main-options
Source: test.exe, 00000001.00000002.2898571267.000001A6041C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ffmpeg.org/ffmpeg.html#Synopsis
Source: test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: test.exe, 00000001.00000002.2898571267.000001A604168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: test.exe, 00000001.00000002.2898571267.000001A604168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/arogozhnikov/einops
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/astral-sh/ruff
Source: test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861194264.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: test.exe, 00000001.00000002.2901949832.000001A60AC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joblib/threadpoolctl
Source: test.exe, 00000000.00000003.1723771923.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1725089225.0000026251917000.00000004.00000020.00020000.00000000.sdmp, win32pdh.pyd.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: test.exe, 00000001.00000002.2898571267.000001A6041C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mitsuhiko/jinja2/blob/master/LICENSE)
Source: test.exe, 00000000.00000003.1666052210.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/opencv/opencv/issues/18502)
Source: test.exe, 00000001.00000002.2898199870.000001A603DD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pydata/bottleneck
Source: test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: test.exe, 00000001.00000002.2898199870.000001A603DD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: test.exe, 00000001.00000002.2898199870.000001A603DD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packagingEI73362
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml-1-0.dll
Source: test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/wheel
Source: test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/wheel/issues
Source: test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: test.exe, 00000001.00000002.2898571267.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.7/Objects/listsort.txt
Source: test.exe, 00000001.00000003.1729864477.000001A601646000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: test.exe, 00000000.00000003.1666052210.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/12302
Source: METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: test.exe, 00000001.00000002.2897735981.000001A6039B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/497
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://graphics.stanford.edu/~seander/bithacks.html#CountBitsSetParallel
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603A67000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041C6000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: METADATA.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipython.org
Source: test.exe, 00000001.00000002.2897735981.000001A603A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: test.exe, 00000001.00000002.2901949832.000001A60ACAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mathworld.wolfram.com/SincFunction.html
Source: test.exe, 00000001.00000002.2901949832.000001A60ACAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://metacpan.org/pod/distribution/Math-Cephes/lib/Math/Cephes.pod#i0:-Modified-Bessel-function-o
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://numpy.org
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://numpy.org/devdocs/numpy_2_0_migration_guide.html#adapting-to-changes-in-the-copy-keyword.
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://numpy.org/devdocs/numpy_2_0_migration_guide.html#adapting-to-changes-in-the-copy-keyword.npy
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604394000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2901949832.000001A60AC60000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861381911.000001A604385000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899346841.000001A604840000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecations
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604394000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861381911.000001A604385000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecations(
Source: test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecations-------
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecationsu
Source: _philox.cp310-win_amd64.pyd.0.dr, _pcg64.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://numpy.org/devdocs/user/troubleshooting-importerror.html#c-api-incompatibility
Source: test.exe, 00000001.00000002.2898571267.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://numpy.org/doc/stable/glossary.html#term-contiguous
Source: test.exe, 00000000.00000003.1694631832.0000026251919000.00000004.00000020.00020000.00000000.sdmp, __init__.py2.0.dr	String found in binary or memory: https://numpy.org/doc/stable/user/basics.subclassing.html
Source: test.exe, 00000001.00000002.2898571267.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041C6000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://numpy.org/neps/nep-0013-ufunc-overrides.html
Source: test.exe, 00000001.00000002.2898571267.000001A604168000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://optimized-einsum.readthedocs.io/en/stable/
Source: test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: test.exe, 00000001.00000002.2898571267.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://people.eecs.berkeley.edu/~wkahan/ieee754status/IEEE754.PDF
Source: test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: test.exe, 00000001.00000002.2901949832.000001A60ACAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_379.htm
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_67.htm
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_69.htm
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_79.htm
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_83.htm
Source: _multiarray_umath.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_86.htm
Source: test.exe, 00000000.00000003.1721479016.0000026251917000.00000004.00000020.00020000.00000000.sdmp, _sfc64.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://pracrand.sourceforge.net/RNG_engines.txt
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/setuptools/
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/threadpoolctl/
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://python-future.org
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://python-future.org/automatic_conversion.html
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://python-future.org/credits.html
Source: test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pythoncharmers.com
Source: test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pythoncharmers.com)
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604394000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861381911.000001A604385000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: test.exe, 00000000.00000003.1718421236.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: test.exe, 00000001.00000003.1737991687.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737991687.000001A6039FF000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737879985.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: test.exe, 00000001.00000003.1737991687.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603A67000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737879985.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1738387566.000001A603A7B000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737959742.000001A603A0E000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737938543.000001A6037A4000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737991687.000001A603A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: test.exe, 00000001.00000003.1737991687.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737879985.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737959742.000001A603A0E000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737938543.000001A6037A4000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737991687.000001A603A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
Source: test.exe, 00000001.00000003.1737991687.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737879985.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737959742.000001A603A0E000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737938543.000001A6037A4000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737991687.000001A603A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
Source: test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861194264.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: METADATA.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
Source: test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
Source: METADATA0.0.dr	String found in binary or memory: https://wheel.readthedocs.io/
Source: test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
Source: test.exe, 00000001.00000003.1738957157.000001A604020000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1738957157.000001A603FE1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A6039B0000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: test.exe, 00000001.00000002.2901949832.000001A60ACAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ams.org/journals/mcom/1988-51-184/
Source: test.exe, 00000000.00000003.1721235426.0000026251917000.00000004.00000020.00020000.00000000.sdmp, _pcg64.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://www.cs.hmc.edu/tr/hmc-cs-2014-0905.pdf
Source: test.exe, 00000000.00000003.1703946818.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1703946818.0000026251921000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gyan.dev/ffmpeg/builds/ffmpeg-release-essentials.zip
Source: test.exe, 00000001.00000003.1741943479.000001A60ACB1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mathworks.com/help/techdoc/ref/rank.html
Source: test.exe, 00000001.00000002.2901949832.000001A60AC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openblas.net/
Source: test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: test.exe, 00000000.00000003.1721235426.0000026251917000.00000004.00000020.00020000.00000000.sdmp, _pcg64.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://www.pcg-random.org/
Source: test.exe, 00000000.00000003.1721479016.0000026251917000.00000004.00000020.00020000.00000000.sdmp, _sfc64.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
Source: test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: test.exe, 00000001.00000002.2897735981.000001A603A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: test.exe, 00000000.00000003.1665429672.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0427/
Source: test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1730387353.000001A6036CC000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1730909294.000001A6036DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.

Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716701000	0_2_00007FF716701000
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716708BD0	0_2_00007FF716708BD0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716725C70	0_2_00007FF716725C70
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167269D4	0_2_00007FF7167269D4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716720938	0_2_00007FF716720938
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716729798	0_2_00007FF716729798
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167117B0	0_2_00007FF7167117B0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716711FD0	0_2_00007FF716711FD0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716718804	0_2_00007FF716718804
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71671DF60	0_2_00007FF71671DF60
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167218E4	0_2_00007FF7167218E4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716709870	0_2_00007FF716709870
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716715DA0	0_2_00007FF716715DA0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716711DC4	0_2_00007FF716711DC4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71671E5E0	0_2_00007FF71671E5E0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716713610	0_2_00007FF716713610
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71670AD1D	0_2_00007FF71670AD1D
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716725EEC	0_2_00007FF716725EEC
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716719F10	0_2_00007FF716719F10
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716711BC0	0_2_00007FF716711BC0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71670A34B	0_2_00007FF71670A34B
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71670A4E4	0_2_00007FF71670A4E4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716723C80	0_2_00007FF716723C80
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716712C80	0_2_00007FF716712C80
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716726488	0_2_00007FF716726488
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716720938	0_2_00007FF716720938
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167119B4	0_2_00007FF7167119B4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167121D4	0_2_00007FF7167121D4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716713A14	0_2_00007FF716713A14
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71672411C	0_2_00007FF71672411C
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF716718154	0_2_00007FF716718154
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71671DACC	0_2_00007FF71671DACC
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716701000	1_2_00007FF716701000
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716725C70	1_2_00007FF716725C70
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167269D4	1_2_00007FF7167269D4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716729798	1_2_00007FF716729798
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167117B0	1_2_00007FF7167117B0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716711FD0	1_2_00007FF716711FD0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716718804	1_2_00007FF716718804
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71671DF60	1_2_00007FF71671DF60
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167218E4	1_2_00007FF7167218E4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716709870	1_2_00007FF716709870
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716715DA0	1_2_00007FF716715DA0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716711DC4	1_2_00007FF716711DC4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71671E5E0	1_2_00007FF71671E5E0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716713610	1_2_00007FF716713610
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71670AD1D	1_2_00007FF71670AD1D
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716725EEC	1_2_00007FF716725EEC
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716719F10	1_2_00007FF716719F10
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716711BC0	1_2_00007FF716711BC0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716708BD0	1_2_00007FF716708BD0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71670A34B	1_2_00007FF71670A34B
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71670A4E4	1_2_00007FF71670A4E4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716723C80	1_2_00007FF716723C80
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716712C80	1_2_00007FF716712C80
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716726488	1_2_00007FF716726488
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716720938	1_2_00007FF716720938
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167119B4	1_2_00007FF7167119B4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167121D4	1_2_00007FF7167121D4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716713A14	1_2_00007FF716713A14
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71672411C	1_2_00007FF71672411C
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716720938	1_2_00007FF716720938
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF716718154	1_2_00007FF716718154
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71671DACC	1_2_00007FF71671DACC

Source: C:\Users\user\Desktop\test.exe	Code function: String function: 00007FF716702710 appears 104 times
Source: C:\Users\user\Desktop\test.exe	Code function: String function: 00007FF716702910 appears 34 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: cv2.pyd.0.dr	Static PE information: Number of sections : 11 > 10
Source: opencv_videoio_ffmpeg4100_64.dll.0.dr	Static PE information: Number of sections : 13 > 10
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: Number of sections : 19 > 10

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1724467638.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs test.exe
Source: test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs test.exe
Source: test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1718421236.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs test.exe
Source: test.exe, 00000000.00000003.1723876938.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1661670788.0000026251912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1662370578.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1664042926.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1661949696.0000026251914000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1663258208.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663390115.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662466153.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1663476327.0000026251916000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1665091933.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663976148.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1664432273.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1664561081.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1661806036.0000026251912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1660926673.0000026251912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs test.exe
Source: test.exe, 00000000.00000003.1662749478.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1665022871.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663069892.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1661033684.0000026251912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs test.exe
Source: test.exe, 00000000.00000003.1664170530.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1661435042.0000026251912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1664955089.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs test.exe
Source: test.exe, 00000000.00000003.1722184856.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1662623856.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663667932.0000026251916000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662209701.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1663327681.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1665165455.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1663004612.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1662688174.0000026251915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1723771923.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes310.dll0 vs test.exe
Source: test.exe, 00000000.00000003.1662036446.0000026251914000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs test.exe
Source: test.exe, 00000000.00000003.1663540336.0000026251916000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000000.00000003.1725089225.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32pdh.pyd0 vs test.exe
Source: test.exe, 00000000.00000003.1664105921.0000026251917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs test.exe
Source: test.exe, 00000001.00000002.2897297543.000001A602FD0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs test.exe

Source: classification engine

Classification label: mal48.troj.winEXE@3/119@0/1

Source: C:\Users\user\Desktop\test.exe

File created: C:\Users\user\Desktop\overlay_image.jpg

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI73362

Jump to behavior

Source: test.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\test.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

File read: C:\Users\user\Desktop\test.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"
Source: C:\Users\user\Desktop\test.exe	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"
Source: C:\Users\user\Desktop\test.exe	Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"	Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: msvcp140-8021418012832a07a8ca5105a33b1086.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: mfreadwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: mfcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\test.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: test.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: test.exe

Static file information: File size 62866063 > 1048576

Source: test.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: test.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: test.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: test.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: test.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: test.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: test.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: test.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: test.exe, 00000000.00000003.1665022871.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: test.exe, 00000000.00000003.1662870684.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: test.exe, 00000000.00000003.1661033684.0000026251912000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: test.exe, 00000000.00000003.1663327681.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: test.exe, 00000000.00000003.1662688174.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: test.exe, 00000000.00000003.1663976148.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: test.exe, 00000000.00000003.1664369097.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: test.exe, 00000000.00000003.1722314903.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897297543.000001A602FD0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: test.exe, 00000000.00000003.1665091933.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: test.exe, 00000000.00000003.1663069892.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: test.exe, 00000000.00000003.1664105921.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: test.exe, 00000000.00000003.1663849395.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: test.exe, 00000000.00000003.1662036446.0000026251914000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: test.exe, 00000000.00000003.1661105637.0000026251912000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: test.exe, 00000000.00000003.1662036446.0000026251914000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: test.exe, 00000000.00000003.1662749478.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: test.exe, 00000000.00000003.1723876938.0000026251917000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: test.exe, 00000000.00000003.1724797589.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: test.exe, 00000000.00000003.1663540336.0000026251916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: test.exe, 00000000.00000003.1662810385.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: test.exe, 00000000.00000003.1664860101.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: test.exe, 00000000.00000003.1664234412.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: test.exe, 00000000.00000003.1660926673.0000026251912000.00000004.00000020.00020000.00000000.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: test.exe, 00000000.00000003.1663667932.0000026251916000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: test.exe, 00000000.00000003.1665235058.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: test.exe, 00000000.00000003.1663004612.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: test.exe, 00000000.00000003.1663476327.0000026251916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: test.exe, 00000000.00000003.1662623856.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: test.exe, 00000000.00000003.1664170530.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: _ctypes.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: test.exe, 00000000.00000003.1662304478.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: test.exe, 00000000.00000003.1663258208.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: test.exe, 00000000.00000003.1664561081.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32pdh.pdb source: test.exe, 00000000.00000003.1725089225.0000026251917000.00000004.00000020.00020000.00000000.sdmp, win32pdh.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: test.exe, 00000000.00000003.1662209701.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: test.exe, 00000000.00000003.1663390115.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: test.exe, 00000000.00000003.1664042926.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: test.exe, 00000000.00000003.1663793038.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: test.exe, 00000000.00000003.1662140935.0000026251915000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: test.exe, 00000000.00000003.1662940422.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: test.exe, 00000000.00000003.1664955089.0000026251917000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: test.exe, 00000000.00000003.1662370578.0000026251915000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: test.exe, 00000000.00000003.1663127815.0000026251915000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: test.exe, 00000000.00000003.1661435042.0000026251912000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: test.exe, 00000000.00000003.1661949696.0000026251914000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: test.exe, 00000000.00000003.1664432273.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: test.exe, 00000000.00000003.1665165455.0000026251917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.0.dr

Source: test.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: test.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: test.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: test.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: test.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: opencv_videoio_ffmpeg4100_64.dll.0.dr	Static PE information: section name: .rodata
Source: opencv_videoio_ffmpeg4100_64.dll.0.dr	Static PE information: section name: .xdata
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: .xdata
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /4
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /19
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /31
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /45
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /57
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /70
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /81
Source: libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll.0.dr	Static PE information: section name: /92
Source: msvcp140-8021418012832a07a8ca5105a33b1086.dll.0.dr	Static PE information: section name: .didat
Source: cv2.pyd.0.dr	Static PE information: section name: IPPCODE
Source: cv2.pyd.0.dr	Static PE information: section name: IPPDATA
Source: cv2.pyd.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_webp.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingtk.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_common.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingmath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\yaml\_yaml.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imaging.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_sfc64.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_philox.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy.libs\libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\bit_generator.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_mt19937.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_generator.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_bounded_integers.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\mtrand.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\_core\_multiarray_umath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\_core\_multiarray_tests.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_pcg64.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\linalg\_umath_linalg.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy.libs\msvcp140-8021418012832a07a8ca5105a33b1086.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingcms.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\fft\_pocketfft_umath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\opencv_videoio_ffmpeg4100_64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\cv2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73362\libcrypto-1_1.dll	Jump to dropped file

Source: C:\Users\user\Desktop\test.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49739

Source: C:\Users\user\Desktop\test.exe

Code function: 0_2_00007FF716705820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF716705820

Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_webp.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingtk.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_common.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingmath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\yaml\_yaml.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imaging.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_sfc64.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_philox.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\bit_generator.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_mt19937.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_generator.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_bounded_integers.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\mtrand.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\_core\_multiarray_umath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\_core\_multiarray_tests.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_pcg64.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\linalg\_umath_linalg.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingcms.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\fft\_pocketfft_umath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\opencv_videoio_ffmpeg4100_64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\cv2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\test.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\test.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18173

Source: C:\Users\user\Desktop\test.exe

API coverage: 8.9 %

Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167092F0 FindFirstFileExW,FindClose,	0_2_00007FF7167092F0
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167218E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7167218E4
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF7167083B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7167083B0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167092F0 FindFirstFileExW,FindClose,	1_2_00007FF7167092F0
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167218E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7167218E4
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF7167083B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF7167083B0

Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\AppData\Roaming\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\Application Data\Microsoft\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	File opened: C:\Documents and Settings\Default\Application Data\	Jump to behavior

Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4b11b7a3cc41b
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tic.resamd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: bf3856aamd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-storflt_31bf3856ad364e35_10.0.19041.1_none_cce38a03f1e40067.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .0.1904amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580.manifest.
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bdacc15dllll0
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-f..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_4d711034023df04d.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326t.exe
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ne_a39famd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586.manifestt-pn
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3`<
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-drivers-hypervisor-bcd_31bf3856ad364e35_10.0.19041.1_none_cbb2f6c087e55fc0.manifest-ms
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ation_damd64_microsoft-hyper-v-vstack_31bf3856ad364e35_10.0.19041.1_none_1aae8085937aee95.manifest (
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-hypervisor-events_31bf3856ad364e35_10.0.19041.1_none_642b49da78e510c8.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: d1c7724amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379.manifestlus.
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ui_0da4amd64_microsoft-hyper-v-h..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_53df9e1a6706366c.manifestf_Pf
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: svc.dllamd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67.manifest_30m
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2
Source: test.exe, 00000001.00000002.2902906834.000001A60B6E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.manin752p
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8416.exeVL_
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd0ebd3d8c
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8.manifest-ms
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd6211270mw
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-drivers-hypervisor-bcd_31bf3856ad364e35_10.0.19041.1_none_cbb2f6c087e55fc0.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vdev-offline_31bf3856ad364e35_10.0.19041.1_none_92013f260f9b1b7b.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda.manifest
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955rsApi.dllP
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dpSaProamd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-management-clients_31bf3856ad364e35_10.0.19041.1_none_a87cce111f2d21d5.manifestms
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0
Source: test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de9487ebd55p
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B6E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.man
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-rdv_31bf3856ad364e35_10.0.19041.928_none_58e4b5397f9ab13a.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0_modulamd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-guest-network-drivers_31bf3856ad364e35_10.0.19041.1_none_2cfac380b9544760.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: es_msftamd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141.manifestour
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 6_comctamd64_microsoft-hyper-v-d..ers-vmswitch-common_31bf3856ad364e35_10.0.19041.1_none_e5de88ec9eb30808.manifests_60^
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..p-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_27157646a7f74243.manifest-
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: md64_miamd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_31900babde4397db.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_e16d8a57f6edf359.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-guest-network-drivers_31bf3856ad364e35_10.0.19041.1_none_2cfac380b9544760.manifests915
Source: test.exe, 00000001.00000002.2902906834.000001A60B758000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: aea5cc7amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87.manifestde0
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79.manifestf4
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8cll
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-rdv_31bf3856ad364e35_10.0.19041.928_none_58e4b5397f9ab13a.manifestd_memtest.exe.P
Source: test.exe, 00000001.00000003.1987714832.000001A60CB40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040.manifest0
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_90826ff4620798e4.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135ost.dlle
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fd_memtamd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981.manifests_3
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: indows-amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.2006_none_f93d3f541072d580
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ui_0da4amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5.manifest291.cdf-ms_p_
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tic.resamd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d
Source: test.exe, 00000001.00000003.1987714832.000001A60CB40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-dmvsc_31bf3856ad364e35_10.0.19041.1_none_5cb76f18a25ee556.manifest`<
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-storvsp_31bf3856ad364e35_10.0.19041.1_none_cb2cd273f2fa3722.manifest
Source: test.exe, 00000001.00000003.2012016515.000001A60C940000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..n-merged-deployment_31bf3856ad364e35_10.0.19041.1566_none_4d0af6f3ee4c927e.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 95b6414amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-emulatedstorage_31bf3856ad364e35_10.0.19041.1741_none_4fe99c993cb84326.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_53df9e1a6706366c.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8sEnv.dlldllp
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-hypervisor-events_31bf3856ad364e35_10.0.19041.1_none_642b49da78e510c8.manifestcdf-mst.
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0.0.190amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24.manifest_microsoft-0\|
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13w
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5cc96
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 41.1_noamd64_microsoft-hyper-v-m..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_90826ff4620798e4.manifests
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87exell
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wspoweramd64_microsoft-hyper-v-storvsp_31bf3856ad364e35_10.0.19041.1_none_cb2cd273f2fa3722.manifestft-
Source: test.exe, 00000001.00000002.2902906834.000001A60B6E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\microsoft-hyper-v-drivers-migration-replacement.mantion-plugin`
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: _6de3ffamd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de.manifestont
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..r-merged-deployment_31bf3856ad364e35_10.0.19041.1_none_479626a02c4fee1b.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-3dvideo.resources_31bf3856ad364e35_10.0.19041.928_en-us_4257e8c2720c2e68.manifest1_fi-f
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141ncom.dll
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wspoweramd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7.manifest_syswow64_wind
Source: test.exe, 00000001.00000002.2902906834.000001A60B6E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.man
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: urc_09aamd64_microsoft-hyper-v-vmbus_31bf3856ad364e35_10.0.19041.1_none_8d60e49d6e4b7e60.manifestll_v1
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: indows-amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_31900babde4397db.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_0544b95dbde97edc.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0.0.190amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127.manifest_microsoft-Pu
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: r_76d46amd64_microsoft-hyper-v-p..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_8b1c06953b85da99.manifestgno
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: bf3856aamd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_en-us_8e6d1518accc0bf5.manifest105
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.867_none_b57fce26790eec13
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: l_303b0amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0.manifestgno
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..rvisor-host-service_31bf3856ad364e35_10.0.19041.1_none_2246f2e6f0441379ur32.dllmR
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-passthru-parser_31bf3856ad364e35_10.0.19041.1_none_d7dfb451bd621127.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98.manifest95b46`<
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61UICtrl
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: o_80fc9amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790.manifestetna
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-3dvideo_31bf3856ad364e35_10.0.19041.928_none_b394b845725c83f9.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b.manifestf-ms0c
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66lat@rw
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..lebrowser.resources_31bf3856ad364e35_10.0.19041.1_en-us_4373d0692dcd3a06.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd.manifestexe.px
Source: test.exe, 00000001.00000003.2012016515.000001A60C940000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164L
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: astapi.amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser_31bf3856ad364e35_10.0.19041.1_none_a7bb53746630ebd3.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-firewallrules_31bf3856ad364e35_10.0.19041.1_none_89d7babee737651c.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 6amd64_microsoft-hyper-v-m..ients-firewallrules_31bf3856ad364e35_10.0.19041.1_none_a0e7047dc07f4f53.manifest1904
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24lpw
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: eAgentcamd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-remotefilebrowser_31bf3856ad364e35_10.0.19041.746_none_6fbcad1699b89a67.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-h..r-merged-deployment_31bf3856ad364e35_10.0.19041.1_none_479626a02c4fee1b.manifesth-t
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15pow
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack_31bf3856ad364e35_10.0.19041.1_none_1aae8085937aee95.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_165edb2e5d580618.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..p-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_27157646a7f74243.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: redstatamd64_microsoft-hyper-v-storflt_31bf3856ad364e35_10.0.19041.1_none_cce38a03f1e40067.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..-client.snapinabout_31bf3856ad364e35_10.0.19041.1_none_43a9017744e82ca8
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..rvcluster.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71570953289cd4d0.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79\
Source: test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..-netsetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_299ac5951a49c2de
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.2006_none_a526c6e91aabcb1b
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0_modulamd64_microsoft-hyper-v-hgs_31bf3856ad364e35_10.0.19041.1741_none_1bf0e7c12b78479b.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 3465.cdamd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96.manifest0$
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2wapi.dlll
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_en-us_fc0cba9450a52790VolSSO.dllssP
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_e0127aac1cc27b15.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ow64_miamd64_microsoft-hyper-v-vstack-hypervcluster_31bf3856ad364e35_10.0.19041.1_none_a2ace16370124ff4.manifestcc
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ow64_miamd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_0544b95dbde97edc.manifestt
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-3dvideo.resources_31bf3856ad364e35_10.0.19041.928_en-us_4257e8c2720c2e68.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ow64_miamd64_microsoft-hyper-v-sysprep-provider_31bf3856ad364e35_10.0.19041.789_none_111728dc239a85e2.manifestcbcc
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb.resources_31bf3856ad364e35_10.0.19041.423_en-us_f14a4bbefe65ac87
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..apinabout.resources_31bf3856ad364e35_10.0.19041.1_en-us_d314f4eb3925c8b5.manifest_fi
Source: test.exe, 00000001.00000003.1987714832.000001A60CB40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-dmvsc_31bf3856ad364e35_10.0.19041.1_none_5cb76f18a25ee556.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ui_77b8amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d.manifest35_Pz
Source: test.exe, 00000001.00000002.2903362049.000001A60CC40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.19041.1_none_97e0d8d7edeea164.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: $_syswoamd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61.manifest3944d@)
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vmbus_31bf3856ad364e35_10.0.19041.1_none_8d60e49d6e4b7e60.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981impl.dll
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 364e35~amd64_microsoft-hyper-v-lun-parser_31bf3856ad364e35_10.0.19041.1_none_b6d8bfc73f89cc96`<
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vid_31bf3856ad364e35_10.0.19041.1_none_56baaad119b4f126.manifestconfigu'
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-synthfcvdev_31bf3856ad364e35_10.0.19041.1741_none_b365912b94b35a98.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vid_31bf3856ad364e35_10.0.19041.1_none_56baaad119b4f126.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vid.resources_31bf3856ad364e35_10.0.19041.1_en-us_447494df1222bcd8mgr.vbsl
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 64\amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_en-gb_7788797720472f2d
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-p..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_8b1c06953b85da99.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_e16d8a57f6edf359.manifest31f0r
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-i..ationcomponents-rdv_31bf3856ad364e35_10.0.19041.1741_none_b62736d427ac1a0c.manifest0h
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 3856ad3amd64_microsoft-hyper-v-vhd-parser_31bf3856ad364e35_10.0.19041.1_none_34b87765e20dcc15.manifestp&
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.2006_none_ab6b7b2814133920.manifestdf-msfestP
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ESAMPLEamd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..nthfcvdev.resources_31bf3856ad364e35_10.0.19041.1_en-us_6ca4b4247e291981
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-k..erformance-counters_31bf3856ad364e35_10.0.19041.1_none_e0127aac1cc27b15.manifesti_f6Pk
Source: test.exe, 00000001.00000002.2897735981.000001A6039B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..failoverreplication_31bf3856ad364e35_10.0.19041.1_none_50b60ffc14c70fb2.manifest_ko-
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203a
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.1741_none_78a9b11b7a3cc41b.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-config_31bf3856ad364e35_10.0.19041.928_none_d35bf07ab5380c24
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ation_damd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..s-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_68a612f12d9ba982.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_en-us_369e8b635061fdb3.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-f..wallrules.resources_31bf3856ad364e35_10.0.19041.1_en-us_4d711034023df04d.manifestPa
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-o..oyment-languagepack_31bf3856ad364e35_10.0.19041.1_en-gb_165edb2e5d580618.manifesta83
Source: test.exe, 00000001.00000003.1987714832.000001A60CB40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1741_none_7543ca68a11c7040.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lient-pamd64_microsoft-hyper-v-pvhd-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_0ccb9f4751718744
Source: test.exe, 00000001.00000002.2902906834.000001A60B758000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fesmicrosoft-hyper-v-migration-replacement.mannn
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda.manifestf6c9.cdf-ms
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..ients-firewallrules_31bf3856ad364e35_10.0.19041.1_none_a0e7047dc07f4f53.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa.resources_31bf3856ad364e35_10.0.19041.1_en-us_168291f09487ebd5.manifest
Source: test.exe, 00000000.00000003.1665702492.0000026251917000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-pvhd-parser_31bf3856ad364e35_10.0.19041.1645_none_fe1307608fa06d8c.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ce6_comamd64_microsoft-hyper-v-h..t-service.resources_31bf3856ad364e35_10.0.19041.1_en-us_ddaeabc80a3525d6.manifests1
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-vdev-offline_31bf3856ad364e35_10.0.19041.1_none_92013f260f9b1b7b.manifest0
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 32\amd64_microsoft-hyper-v-vstack-vsmb_31bf3856ad364e35_10.0.19041.1741_none_a3a0448c191b2fda
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wspoweramd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1949_none_a9b86d6c1534dc66.manifestyswow64_wind
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-p..e-merged-deployment_31bf3856ad364e35_10.0.19041.1415_none_36f742b3b56a2468.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmclr_31bf3856ad364e35_10.0.19041.1889_none_46e4953b6f70cc79.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_en-us_a3e0d97c4c052586.execpl
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ui_77b8amd64_microsoft-hyper-v-o..s-merged-deployment_31bf3856ad364e35_10.0.19041.1741_none_68a612f12d9ba982.manifest_ps
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 06_memtamd64_microsoft-hyper-v-p..e-merged-deployment_31bf3856ad364e35_10.0.19041.1415_none_36f742b3b56a2468.manifest3
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-kmcl_31bf3856ad364e35_10.0.19041.1889_none_e7d7bde611c8c141.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Fiamd64_microsoft-hyper-v-o..n-merged-deployment_31bf3856ad364e35_10.0.19041.1566_none_4d0af6f3ee4c927e.manifestPp
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: eso_e32amd64_microsoft-hyper-v-3dvideo_31bf3856ad364e35_10.0.19041.928_none_b394b845725c83f9.manifest1`!
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-firewallrules_31bf3856ad364e35_10.0.19041.1_none_89d7babee737651c.manifest-mstl32.dll.pd
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ion.proamd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_en-us_b3d1ef0d088d6955.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_en-us_50c23e4c771f203afolder.dlless
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: egsvr32amd64_microsoft-hyper-v-vstack-vid_31bf3856ad364e35_10.0.19041.546_none_58a869077fc6e2f7
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8.manifest
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_en-us_5ee8ada67d246bda
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ers-vmswitch-common_31bf3856ad364e35_10.0.19041.1_none_e5de88ec9eb30808.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-v..ck-virtualizationv2_31bf3856ad364e35_10.0.19041.1_none_25a2ff96aac272dd.manifest
Source: test.exe, 00000001.00000003.2012170854.000001A60CA40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: indows.amd64_microsoft-hyper-v-integration-rdv-core_31bf3856ad364e35_10.0.19041.964_none_3542494c595902f8.manifestspi
Source: test.exe, 00000001.00000002.2902906834.000001A60B760000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: amd64_microsoft-hyper-v-d..ypervisor.resources_31bf3856ad364e35_10.0.19041.1_en-us_c2edb07518552135

Source: C:\Users\user\Desktop\test.exe

Code function: 0_2_00007FF71671A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF71671A684

Source: C:\Users\user\Desktop\test.exe

Code function: 0_2_00007FF7167234F0 GetProcessHeap,

0_2_00007FF7167234F0

Source: C:\Users\user\Desktop\test.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71670C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF71670C910
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71671A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF71671A684
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71670D37C SetUnhandledExceptionFilter,	0_2_00007FF71670D37C
Source: C:\Users\user\Desktop\test.exe	Code function: 0_2_00007FF71670D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF71670D19C
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71670C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF71670C910
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71671A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF71671A684
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71670D37C SetUnhandledExceptionFilter,	1_2_00007FF71670D37C
Source: C:\Users\user\Desktop\test.exe	Code function: 1_2_00007FF71670D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF71670D19C

Source: C:\Users\user\Desktop\test.exe

Process created: C:\Users\user\Desktop\test.exe "C:\Users\user\Desktop\test.exe"

Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Code function: 0_2_00007FF7167295E0 cpuid

0_2_00007FF7167295E0

Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\misc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy.libs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\_core VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-console-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-2-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-handle-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-heap-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-interlocked-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-libraryloader-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-profile-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-string-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-2-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-environment-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-filesystem-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-heap-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-locale-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-math-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-process-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-string-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-time-l1-1-0.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\cv2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\test.exe	Queries volume information: C:\Users\user\Desktop\test.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\test.exe

Code function: 0_2_00007FF71670D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF71670D080

Source: C:\Users\user\Desktop\test.exe

Code function: 0_2_00007FF716725C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF716725C70

Source: C:\Users\user\Desktop\test.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
test.exe	5%	ReversingLabs	Win64.Malware.Generic
test.exe	6%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imaging.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingcms.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingmath.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingtk.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_webp.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_cffi_backend.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\cv2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\mat_wrapper\__init__.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\misc\__init__.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\opencv_videoio_ffmpeg4100_64.dll	5%	ReversingLabs

Source	Detection	Scanner	Label
https://optimized-einsum.readthedocs.io/en/stable/	0%	Avira URL Cloud	safe
https://python-future.org	0%	Avira URL Cloud	safe
https://dmlc.github.io/dlpack/latest/python_spec.html	0%	Avira URL Cloud	safe
https://importlib-metadata.readthedocs.io/	0%	Avira URL Cloud	safe
https://wheel.readthedocs.io/en/stable/news.html	0%	Avira URL Cloud	safe
http://httpbin.org/	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy	0%	Avira URL Cloud	safe
http://www.scipy.org/not/real/data.txt	0%	Avira URL Cloud	safe
http://crl4.dig	0%	Avira URL Cloud	safe
https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm	0%	Avira URL Cloud	safe
http://www.pcg-random.org/	0%	Avira URL Cloud	safe
https://personal.math.ubc.ca/~cbm/aands/page_83.htm	0%	Avira URL Cloud	safe
http://crl3.digicert.co	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://python-future.org	test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://numpy.org/devdocs/release/1.20.0-notes.html#deprecations	test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604394000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2901949832.000001A60AC60000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861381911.000001A604385000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899346841.000001A604840000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.scipy.org/not/real/data.txt	test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/astral-sh/ruff	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/giampaolo/psutil/issues/875.	test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861194264.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cloud.google.com/appengine/docs/standard/runtimes	test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/python/importlib_metadata/issues	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wheel.readthedocs.io/en/stable/news.html	test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://importlib-metadata.readthedocs.io/	METADATA.0.dr	false	Avira URL Cloud: safe	unknown
http://goo.gl/zeJZl.	test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/	test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dmlc.github.io/dlpack/latest/python_spec.html	test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/packaging	test.exe, 00000001.00000002.2898199870.000001A603DD0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://graphics.stanford.edu/~seander/bithacks.html#CountBitsSetParallel	_multiarray_umath.cp310-win_amd64.pyd.0.dr	false		high
https://personal.math.ubc.ca/~cbm/aands/page_379.htm	test.exe, 00000001.00000002.2901949832.000001A60ACAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://blog.jaraco.com/skeleton	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/platformdirs/platformdirs	test.exe, 00000001.00000002.2898199870.000001A603DD0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A603FE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ffmpeg.org/ffmpeg-filters.html#vflip	test.exe, 00000001.00000002.2899346841.000001A604840000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;	test.exe, 00000001.00000003.1737991687.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737879985.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737959742.000001A603A0E000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737938543.000001A6037A4000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737991687.000001A603A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://json.org	test.exe, 00000001.00000002.2898397083.000001A603FE0000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://numpy.org/devdocs/user/troubleshooting-importerror.html#c-api-incompatibility	_philox.cp310-win_amd64.pyd.0.dr, _pcg64.cp310-win_amd64.pyd.0.dr	false		high
http://httpbin.org/	test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://digitalassets.lib.berkeley.edu/sdtr/ucb/text/34.pdf	test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://doi.org/10.1109/IEEESTD.2008.4610935	test.exe, 00000001.00000002.2898571267.000001A6041C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pypi.org/project/build/).	test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000002.2899089954.000001A604510000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/packagingEI73362	test.exe, 00000001.00000002.2898199870.000001A603DD0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/wheel	test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://www.python.org/dev/peps/pep-0427/	test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ffmpeg.org/ffmpeg-filters.html#setpts_002c-asetpts	test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	test.exe, 00000001.00000002.2901737460.000001A60AB70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://numpy.org/devdocs/release/1.20.0-notes.html#deprecations(	test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604394000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861381911.000001A604385000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://metacpan.org/pod/distribution/Math-Cephes/lib/Math/Cephes.pod#i0:-Modified-Bessel-function-o	test.exe, 00000001.00000002.2901949832.000001A60ACAD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/badge/skeleton-2024-informational	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the	test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	test.exe, 00000001.00000002.2898571267.000001A604168000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604108000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	test.exe, 00000001.00000002.2899153550.000001A604610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ffmpeg.org/ffmpeg-filters.html#crop	test.exe, 00000001.00000003.1741871596.000001A603B09000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861194264.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861430218.000001A603B92000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887968918.000001A603B98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ffmpeg.org/ffmpeg-filters.html#hue	test.exe, 00000001.00000002.2897432214.000001A6036B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/pull/12302	test.exe, 00000000.00000003.1666052210.0000026251917000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl4.dig	test.exe, 00000000.00000003.1722758543.0000026251917000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.shields.io/pypi/v/importlib_metadata.svg	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/jaraco/jaraco.functools/issues/5	test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	test.exe, 00000001.00000002.2897514642.000001A6037B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	test.exe, 00000001.00000002.2897735981.000001A6039B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	test.exe, 00000001.00000002.2897735981.000001A603A67000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	test.exe, 00000000.00000003.1718421236.0000026251917000.00000004.00000020.00020000.00000000.sdmp	false		high
https://optimized-einsum.readthedocs.io/en/stable/	test.exe, 00000001.00000002.2898571267.000001A604168000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ffmpeg.org/ffmpeg-filters.html#drawtext	test.exe, 00000001.00000003.1741055080.000001A6041F1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A6041F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy	test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	test.exe, 00000001.00000002.2897203660.000001A602ED0000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mitsuhiko/jinja2/blob/master/LICENSE)	test.exe, 00000001.00000002.2898571267.000001A6041C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://numpy.org/devdocs/numpy_2_0_migration_guide.html#adapting-to-changes-in-the-copy-keyword.	_multiarray_umath.cp310-win_amd64.pyd.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	test.exe, 00000001.00000003.1729864477.000001A601610000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1729831285.000001A60164B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.google.com/index.html	test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604394000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861381911.000001A604385000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/python/cpython/blob/3.7/Objects/listsort.txt	test.exe, 00000001.00000002.2898571267.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	test.exe, 00000000.00000003.1704688381.0000026251917000.00000004.00000020.00020000.00000000.sdmp	false		high
https://w3c.github.io/html/sec-forms.html#multipart-form-data	test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml	test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html#recipes	test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	test.exe, 00000001.00000002.2898101629.000001A603CD0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pypi.org/project/setuptools/	test.exe, 00000000.00000003.1724122093.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://www.pcg-random.org/	test.exe, 00000000.00000003.1721235426.0000026251917000.00000004.00000020.00020000.00000000.sdmp, _pcg64.cp310-win_amd64.pyd.0.dr	false		high
https://www.openblas.net/	test.exe, 00000001.00000002.2901949832.000001A60AC60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/1024.	test.exe, 00000001.00000002.2899027591.000001A604410000.00000004.00001000.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	test.exe, 00000001.00000002.2897432214.000001A6036B9000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861448295.000001A603720000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887987139.000001A603722000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ffmpeg.org/ffmpeg-filters.html#hflip	test.exe, 00000001.00000002.2899346841.000001A604840000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/	test.exe, 00000001.00000002.2897735981.000001A603A67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://personal.math.ubc.ca/~cbm/aands/page_83.htm	_multiarray_umath.cp310-win_amd64.pyd.0.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/dev/peps/pep-0205/	test.exe, 00000000.00000003.1665429672.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897613130.000001A6038B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl3.digicert.co	test.exe, 00000000.00000003.1664493149.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1665302123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663605819.0000026251916000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663731020.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663192950.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1664306438.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663912533.0000026251917000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1662559228.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663069892.0000026251915000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000000.00000003.1663327681.0000026251915000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm	METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/	test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897049304.000001A6015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/4457745#4457745.	test.exe, 00000001.00000002.2901737460.000001A60AC00000.00000004.00001000.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861194264.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2897735981.000001A603B8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pcg-random.org/	test.exe, 00000000.00000003.1721235426.0000026251917000.00000004.00000020.00020000.00000000.sdmp, _pcg64.cp310-win_amd64.pyd.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pydata/bottleneck	test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://people.eecs.berkeley.edu/~wkahan/ieee754status/IEEE754.PDF	test.exe, 00000001.00000002.2898571267.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1887881168.000001A6042F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/mail/	test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ffmpeg.org/ffmpeg-filters.html#drawbox	test.exe, 00000001.00000002.2897735981.000001A6039B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	test.exe, 00000000.00000003.1706405307.0000026251917000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pypi.org/project/threadpoolctl/	test.exe, 00000001.00000003.1861324181.000001A60434A000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898571267.000001A604359000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1861063823.000001A60432F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r	test.exe, 00000001.00000003.1737991687.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737879985.000001A603A5F000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737959742.000001A603A0E000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737938543.000001A6037A4000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1737991687.000001A603A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577916/	test.exe, 00000001.00000003.1738957157.000001A604020000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1738957157.000001A603FE1000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pypi.org/project/importlib_metadata	test.exe, 00000000.00000003.1703190123.0000026251917000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://ffmpeg.org/ffmpeg-filters.html#colorchannelmixer	test.exe, 00000001.00000002.2899215927.000001A604710000.00000004.00001000.00020000.00000000.sdmp	false		high
http://google.com/mail	test.exe, 00000001.00000002.2898397083.000001A604013000.00000004.00000020.00020000.00000000.sdmp, test.exe, 00000001.00000003.1741085267.000001A604074000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
130.61.86.87	unknown	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583646
Start date and time:	2025-01-03 08:52:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	test.exe
Detection:	MAL
Classification:	mal48.troj.winEXE@3/119@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 67 Number of non-executed functions: 121
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
130.61.86.87	end.exe	Get hash	malicious	Unknown	Browse	130.61.86.87:8888/example.zip

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Hilix.mips.elf	Get hash	malicious	Mirai	Browse	140.238.15.187
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ZOYGRL1ePa.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	158.101.44.242
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingcms.cp310-win_amd64.pyd	end.exe	Get hash	malicious	Unknown	Browse
	1tQ7HC6GOS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imaging.cp310-win_amd64.pyd	end.exe	Get hash	malicious	Unknown	Browse
	1tQ7HC6GOS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingmath.cp310-win_amd64.pyd	end.exe	Get hash	malicious	Unknown	Browse
	1tQ7HC6GOS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imaging.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2581504
Entropy (8bit):	6.45702633019264
Encrypted:	false
SSDEEP:	49152:cXJZ2yO4Iom0Uo+K7odkwMHALrLrLrLFcJiSL:UMLK7oKt
MD5:	A3CAE207BD9E2513AE1D72A16D202AAE
SHA1:	354B0C42FD0AA852B5189EEF67FE50A484A8161F
SHA-256:	67C0E06BDE830A9552EA601DD271387EA0AC5F32308F3CD399693C3B98389960
SHA-512:	E58872071E61EA528B45C1ADFB5AF74AD5E568AFFF7D38A2ADC1E22270F4B7C78E061B4E7B193E9E69200DB665DD489D168E8E20691667EEBDE9BC521E58450A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: end.exe, Detection: malicious, Browse Filename: 1tQ7HC6GOS.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........<.%Z].vZ].vZ].vS%)vJ].vO".wX].vO"Gv^].vO".wT].vO".wR].vO".w^].v.(.wX].v.%.w]].vZ].v_\.vZ].vA].v`.w\|\.v`.w.].v`.w[].v`.Ev[].v`.w[].vRichZ].v................PE..d...g.e.........." ...%............,U........................................'...........`.........................................p.%.`.....%.......'.......&...............'.....P{$......................{$.(....z$.@............................................text............................... ..`.rdata..4).......*..................@..@.data........&..`....%.............@....pdata........&......@&.............@..@.rsrc.........'......L'.............@..@.reloc........'......N'.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingcms.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	262656
Entropy (8bit):	6.288727427123961
Encrypted:	false
SSDEEP:	6144:5IzOs0LsbbcOYRI7OrhdlnLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwL/gQ5ge:uzOs0OGhdlnLg9uP1+74/LgHmPr9qvZ/
MD5:	9C8DAC02BA13BA7B32E9CCACFD6B7007
SHA1:	3A82EEA921B105E81D1362D0852544A1CA4D5BA8
SHA-256:	61D5DAF945C8C0436ABE8E7CB273B6CD9389B585CBF3B1BDD0326BE62BBD9D10
SHA-512:	5358853483A62F0E119465CA6B3F9C8AE3C1F076282A6FE3A9794DBC3990A54DD25BFF22E60508DB278126A52B396F6514ED1B43219A8C4F7D4F982BB63D840D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: end.exe, Detection: malicious, Browse Filename: 1tQ7HC6GOS.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R6V[.W8..W8..W8../...W8..(9..W8..(=..W8..(<..W8..(;..W8.."9..W8.]/9..W8..W9.xW8.,.0..W8.,.8..W8.,....W8.,.:..W8.Rich.W8.........................PE..d...W.e.........." ...%....."......<........................................@............`.............................................h...h........ .........../...........0.......`..............................p_..@...............p............................text............................... ..`.rdata.............................@..@.data....?.......:..................@....pdata.../.......0..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingmath.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.587856256597173
Encrypted:	false
SSDEEP:	384:kwU5804Pp/4TsXwCrhBOa8j65NGDIgyJ+:kp80s4T/Crhsp65yt
MD5:	6EAA5FF980649B14215B94D43434A568
SHA1:	33736402DD502EBDD4AA0EA3A92F015F4753E02D
SHA-256:	20329428367A0D176280E40C7553A841ED24CDDDD4F431587EA4E391BAE32BAA
SHA-512:	50CEC14DD2397EE79EAD8D2E06CB65D1CBE92A65E99D2067B61547CBB2D8F463180D5B916B15A3F52369163D11D2F3739AB7FFD4DF0101F10121EFC7952ECB14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: end.exe, Detection: malicious, Browse Filename: 1tQ7HC6GOS.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............@..@..@.....@...A..@...A..@...E..@...D..@...C..@...A..@..A...@...H..@...@..@......@...B..@.Rich.@.................PE..d...X.e.........." ...%.4...,.......8....................................................`.........................................``..h....`..x...............P...............@....U...............................S..@............P..`............................text...X3.......4.................. ..`.rdata.. ....P.......8..............@..@.data........p.......P..............@....pdata..P............R..............@..@.rsrc................Z..............@..@.reloc..@............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingtk.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.938464291761266
Encrypted:	false
SSDEEP:	192:Goq/Ztwu+7WM00KpbQoSM8ZBdVqAdckgTfgZ:yZoHKpcoSFwAZgTo
MD5:	48AFC8244A92ABC0CA92E1FC0CB67C02
SHA1:	0E6D366B9608BDD29790BB53062E3572936E74D3
SHA-256:	6726BA7BC8BC60CFBC392AFCADDFF972EBB74CC4AA17CC0D4A6E13407D1476A7
SHA-512:	33EEFA4D7D86CD0E0E0092E273C6AB7A9EC5BE3D2597DC26DECD6C9E4AC6EB00523A9E199B27E3398400155742A3971FF1556FF36E3574052C3411594B4E3DBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s>...m...m...m..m...m...l...m...l...m...l...m...l...m0..l...m...l..m...m...m...l...m...l...m...m...m...l...mRich...m........PE..d...X.e.........." ...%.....$......@.....................................................`.........................................p;..d....;.......p.......`..................<...`5.............................. 4..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data........P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_webp.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	534528
Entropy (8bit):	6.583043730341305
Encrypted:	false
SSDEEP:	12288:50QIgnVCZh4nbXy8mAC1tQzLrLrLrLWmE5Gx0Hs/JE:504wwnbXBzLrLrLrLWmE60Hs/JE
MD5:	1AAE476B1158C026139B2295D18B7158
SHA1:	976BF0EEE6EE4B464C4957622FCCF7CC5411E56A
SHA-256:	211BCB20C993DF6AB59DE5A7F23545BCC4E329D8363A95A7B6C620F5D3C49964
SHA-512:	151D28731E3747B0BF064E15D0320FB8B5BEB65D1B44BD2DC345034F1D1E84BB292CACC07F3E055A7B95028B9BFB998833518E2A3DFD3A808E249ACD6F03E53F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.v.,.v.,.v.%...&.v.9.w...v.g.w...v.9.s.!.v.9.r.$.v.9.u.(.v..w./.v.,.w...v..Mr.z.v..M~.-.v..Mv.-.v..M..-.v..Mt.-.v.Rich,.v.................PE..d...W.e.........." ...%..................................................................`.............................................\............p....... ..TN..................`W.............................. V..@............................................text............................... ..`.rdata..............................@..@.data....2..........................@....pdata..TN... ...P..................@..@.rsrc........p.......$..............@..@.reloc...............&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38304
Entropy (8bit):	6.3923853431578035
Encrypted:	false
SSDEEP:	768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
MD5:	75E78E4BF561031D39F86143753400FF
SHA1:	324C2A99E39F8992459495182677E91656A05206
SHA-256:	1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
SHA-512:	CE4DAF46BCE44A89D21308C63E2DE8B757A23BE2630360209C4A25EB13F1F66A04FBB0A124761A33BBF34496F2F2A02B8DF159B4B62F1B6241E1DBFB0E5D9756
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L......................h.........G.........:...h.......h.......h.......h.......h.+.....h.......Rich............................PE..d................." ... .:...6.......A..............................................B.....`A.........................................m.......m..x....................n...'......D....c..p...........................`b..@............P..`............................text....9.......:.................. ..`.rdata..."...P...$...>..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..D............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	6.188683787528254
Encrypted:	false
SSDEEP:	3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
MD5:	EBB660902937073EC9695CE08900B13D
SHA1:	881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
SHA-256:	52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
SHA-512:	19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.\|.B/..CKf#C)..C.\|.B&..C.\|.B%..C.\|.B)..Cfq.B)..C.\|.B...C-..C...C.\|.B)..C$qKC,..C.\|.B,..C.\|!C,..C.\|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...\|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.058782298715388
Encrypted:	false
SSDEEP:	192:VZWVghWiZSF8VG+VIYiYF8YGmFF8N0suA5K+o/y2sE9jBF0Ny2aHK:LW2hWiZSf+VIYi+v5AM+o/8E9VF0NyRq
MD5:	7B2104389F75BCAF9A183E6728FC5AF3
SHA1:	7AF1047CAECBA104FB726FDB3649C128E1DCA430
SHA-256:	F75E6C1A5A46A23042B1D28B9AF4E8688DA8A3201F6E1BEB2DE2E314435CC800
SHA-512:	A3CB3461E4D62C5918B3E0EC312E3F4872AA49E129D4D0D968AEB012D021B772EFBF9AF122609E2A93AF00914BBC7B52F789DFBDF971DAC4E5F4FD1E923D068E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......#.....`.........................................`...+............ ..................H/..............8............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.066955768154233
Encrypted:	false
SSDEEP:	384:PUW2hWTZSf+VIYi+vpmAM+o/8E9VF0NyjO:wX/Yi+RmAMxkEs
MD5:	D1F8DCFBF1E7F769AE6860C7264C7D4C
SHA1:	BD1BF21970E120F808C6D9AE089420ACC2827FCD
SHA-256:	C9363FEC30C95976669EF3F35A14786665CBD92E61EB81172DFBFF6C6FB85D5E
SHA-512:	E4C578203947BB757F7AA1F80A3536D21E3D993F7AC5D87BAD7960806F5AC4AA3C130F40F3C2E47E9F1DDFE256DC1BC6164F838AD23EDFCF71307320FF858E17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0.......c....`.........................................`................ ..................H/..............8............................................................................rdata..$...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.070506156797797
Encrypted:	false
SSDEEP:	384:XW2hW2aZSf+VIYi+v2SAM+o/8E9VF0NyRmvn:p5/Yi+RAMxkE+v
MD5:	927674413A12FFE13349916C1CB9EC9B
SHA1:	F12C0DE97E2210AB7CC369128565C642E22CCCBB
SHA-256:	8BBDEBD3360F5E24F006E3427BD79B033E79591D12AAB8A6CAB1A031D7A10116
SHA-512:	F90088E1D2E9598D81BEF70AF21A9F6C1D32D4C3BBC5BAD977DE45200A4395E0FB99C0C20BFC5A78EB0263E46FC47F2DC88CD458A0F2A07E7C218C6E58F5A5C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......2O....`.........................................`................ ..................H/..............8............................................................................rdata..0...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.1115107935418465
Encrypted:	false
SSDEEP:	384:ChRW2hWLZSf+VIYi+vn72AM+o/8E9VF0Ny1VV:Chf//Yi+T2AMxkEz
MD5:	D8625CEB73641841F4D791A10E5AA0CC
SHA1:	BD0A7121536E7FF3025D0C46C04BC54F500745DE
SHA-256:	3A068D030E9004373087C52A3D7289AF64B9CBEEE509B8C47183B1DDF51B3440
SHA-512:	98C67128EFBB672C8C785302BE0939CF21C38554E3649F84DFC89B07E5B029860DA27CFE9706D6011C8BCBEA336A46BE51A48F1F31911FDD455B5DFDE3952660
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......u.....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18792
Entropy (8bit):	6.969304055480929
Encrypted:	false
SSDEEP:	384:bBPvVXgW2hWsGqZSf+VIYi+vGN/AM+o/8E9VF0NyyJ:dPvVXErGx/Yi+YAMxkEQ
MD5:	C454441BDE12F0D06EE0F4A5048EDAA2
SHA1:	8D52B3A139C3DBB3E55E013F61137C3E8772F1A0
SHA-256:	BD020D925A95D98851C1F28E3F3E37090A44C67201F4B05A95CF793170A78E3B
SHA-512:	A7BB5F48EFAA85DBB720849C17EA569F7BEF40AD1029CEBB95F5E21673520D183E7BEAE45FAA1FD9763BDA4DE7B58A243181DA83CC1C0954DFC2C1548381D9EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................@............`.........................................`................0..................h/..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.087440761428274
Encrypted:	false
SSDEEP:	384:ULW2hWQDZSf+VIYi+v9hAM+o/8E9VF0NyjYR8N:Ud6/Yi+bAMxkEik
MD5:	C77578445E0A7C7AAF0097669CF8A7B0
SHA1:	B50FF432095821504BC6B00268C9D0112226E4E5
SHA-256:	F5F0FC82118D1D9BF68A35FCE4F5CFBAD01598681EADC54CB56AD71C1C57128E
SHA-512:	CF649772B85F9DA0E5A707F38E17907F5815033F77B0124F8E1701FA408A506936D99AC9BC95C63D7FABD009539A30935B060A679DFC53B75C7B1D9BA87A4C7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0.......)....`.........................................`...L............ ..................H/..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.163659224001195
Encrypted:	false
SSDEEP:	384:NV6W2hWeZSf+VIYi+v+OAM+o/8E9VF0NyPEuE:NVCs/Yi+xAMxkEWB
MD5:	5FBC5CFEA1D4BC7C9286A888BD36CABA
SHA1:	936AF416794B7A598FE0AA9E02DC0261153A9464
SHA-256:	C4731309E01703F57DBE5DB5C58B7B394090A806E316A381E7BB162FB3935E5C
SHA-512:	304282C5C04320E00798DB05A5C56FC02C37ABAC484F641E4907CAE2DEEFEAB4C011170223CC3B2A5B1CCF8C416329C6C22B49AD179C746271379D56FA27AF2D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d....8.U.........." .........................................................0....... ....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.090049231163983
Encrypted:	false
SSDEEP:	384:LW2hWMkZSf+VIYi+voAM+o/8E9VF0Nygj:dF/Yi+QAMxkEu
MD5:	E72AD22EA306666A4D2ED413FB01E26D
SHA1:	A745AA2B3F1219E97C1183D2A8A6D98F53D4DA21
SHA-256:	A0B4CE721A37620C2A4FF08217387DCF2EF77D935C6EBFCB0E39A8EFF4AF070A
SHA-512:	5E663833EEBC365399637D8C2507EB5087151C4FF1673EF824BF06FAEF0B51D5CF235E973B92EA3B407950683FE4D90E0CF10936B8939C1424FBCD57A8073203
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...38.U.........." .........................................................0.......!....`.........................................`..._............ ..................H/..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.0448657783503705
Encrypted:	false
SSDEEP:	384:jlrW2hWlZSf+VIYi+vyAM+o/8E9VF0NyFk:/h/Yi+6AMxkEY
MD5:	F3F0FDFD4D328818037A917D50D02301
SHA1:	5D816C9E90F2F4404CA2A6D6DCE3DB692AC1835D
SHA-256:	9333DE5729E54A60467707ABB368527B16CAD973602522D332BFE7777A85C640
SHA-512:	D0FE316854C6FA08A52CDE0860C67FC11A8D6DB827715DBEBA5BEA41D39C595B427AFE112D9A34B44AF691BA5F243C426A641E8375DB0B5CE6AEBADEBA63B401
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......z.....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.0982100197109474
Encrypted:	false
SSDEEP:	384:5W2hWWZSf+VIYi+vDAM+o/8E9VF0Nyl4h/:XQ/Yi+LAMxkEW/
MD5:	4D20A51D621E3B2E5E606EE8CA964653
SHA1:	43E3595C25A1D0237AF9CF39A270812B78C33167
SHA-256:	85F568FE0AC210F8E5EF935A13FCA57723481FBF3D03F81CB5EF205496C0A64D
SHA-512:	1F0D30086BAABD4707B20BA1D8AC55244D90039A98C6F1DFCF104972079C91891A4120AC797A09B6E733AB9ED58321CB3667DF622F0DA519004D02ADBAF98786
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0.......a....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.112813774149191
Encrypted:	false
SSDEEP:	384:1vuBL3BaW2hWvZSf+VIYi+vhHAM+o/8E9VF0NyTJVWs6:cBL3Biz/Yi+JHAMxkE/Vm
MD5:	B1E14440722FC63CC0D408A4237A107E
SHA1:	E170A2BF06BC2EF76D84ED3F253421E436D111CF
SHA-256:	546D154B64AA89C1CD8E24F220FA2FD94D9C9603450B6904687C9AE1F4961A97
SHA-512:	62DFD15CC62B8637441D9368BBACD40CCC2505C1E67AD84CFAF28B54C048E6A899AA947D6D507E65A432E690B13879502CF25C60190A3F6A3374A2B7C8BE914E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0...........`.........................................`................ ..................H/..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17736
Entropy (8bit):	7.067268318113535
Encrypted:	false
SSDEEP:	384:+OMw3zdp3bwjGjue9/0jCRrndb4W2hWvZSf+VIYi+v2AM+o/8E9VF0NyMdco:+OMwBprwjGjue9/0jCRrndbMz/Yi++AH
MD5:	670B223B2B794FC632E2CE5138A26EC1
SHA1:	6E62A5AC12768493525A2FFD5206A173B1FBACF5
SHA-256:	10F26333B35891E5CF53B2915E96C879635227EBE7EE591200265D90CC00BF67
SHA-512:	1913735404B7909904352A0ECA49CAEC8B3BBF46B0CE44D728BDD8F3BBA27F30BCF43425A3498EC109D11007635B415128F367A692BE34B3DE27CD91DEEE48C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0.......Q....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.0815107613127815
Encrypted:	false
SSDEEP:	384:bDUW2hW8ZSf+VIYi+vEAM+o/8E9VF0NyXCkCe:oO/Yi+cAMxkEXCe
MD5:	A7FEC788B8534837DB5E8C071FE7975A
SHA1:	07D376552406325D211A79C0EBEDBAC09C463C44
SHA-256:	F1C4CFEE2A3370DC673BE5754128ACBF565BDF0CA240A120D2CE221FD420F73D
SHA-512:	B17AF0F005FC3DAB97FF4805AA7D0DF884F8062CF174D007E03EEB21F91F6D071A903084EF4F2F8A725223A2AAF8C48D2BFC63E4526E22D92AA53215414E0600
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`...l............ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.163388677860738
Encrypted:	false
SSDEEP:	384:3W2hWLSZSf+VIYi+v5onAM+o/8E9VF0NyWX:JIZ/Yi+uAMxkE0
MD5:	4EE6BB6FE7750ED9BE7D93845AEAE3F2
SHA1:	338E52C7B6D7A0FA2B5E41A190B13BEC53C654BC
SHA-256:	495911B1B36E456D1F740EC033CBC5E4D29FDAE57EE12684BCB18BA4C2597510
SHA-512:	B5A6FC257A549C10FC2AFBB0B05F8A68780EDAF56729B3CFDFA52EACCF78735366CDF60D81007B7EC92A23F6B244D5E4D9D04C86F46A829DA930E67AC7352BE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......9.....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	7.042144575324706
Encrypted:	false
SSDEEP:	384:7HW2hW7ZSf+VIYi+vDUAM+o/8E9VF0Nyau:Vb/Yi+rUAMxkEp
MD5:	F01CB66709EEDC2B9665EFB1D604E9A4
SHA1:	202D2BF3DFCEC6F192ECACA796D52E411A9558A1
SHA-256:	F7E5B21E1410549723D7523F187D9B576709C042C5EB5E849E9B139AEB37DD96
SHA-512:	F02508ACF32DBC6D7CC09631D7C010ED27DA2B4E9C0489CA0BD10946BF81F571B50790150B069F75C99951A22236AAADE37661A32654B65D006391DE84DB132A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`...G............ ..................H/..............8............................................................................rdata..h...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17224
Entropy (8bit):	7.081025344656445
Encrypted:	false
SSDEEP:	384:WWXk1JzNcKSIsW2hWGZSf+VIYi+vrLiOAM+o/8E9VF0NypJ:WbcKS54/Yi+jhAMxkE1
MD5:	A585904AFB92B8A141250724597E93BD
SHA1:	5DC40D5314B08294A09BDC6241BE39922D5D17BB
SHA-256:	0D0F9ACC67E53DECE058D4899104A6090FF5D5D7719126F957F7856921F80AEF
SHA-512:	837B607181DDA5A331DCE25F8275B776A3D8D8CD8A1DD0CE0D4ABA45345FD2A32938E93BEFE20D7B0AB7A3857981FB9BF5FCD81CD3519AC003E8F3A23304734F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......+.....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.100477088759649
Encrypted:	false
SSDEEP:	384:8DfIeWW2hWGZSf+VIYi+vCo9/AM+o/8E9VF0NypRq:Le+U/Yi+PhAMxkEk
MD5:	111BE417909AE7DD64A061990424C23B
SHA1:	AAC39E99A900BDA8853E023BD03ECA22AD0794E0
SHA-256:	A417F39DBAE331420D0212FAE8561627D7A28670AC6A29D81EE52D4F01C798A2
SHA-512:	2B4C4DA0E353BF2B6D207E43ADCF99EE72F7602DC108821D2FBB25E4BFE5227900AAB16F218DC77E4ABF65B5830A2E93D7F0EC22AF200DA47FE30F6C65D3915D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14664
Entropy (8bit):	7.195299519452423
Encrypted:	false
SSDEEP:	384:ySeW2hWwZSf+VIYi+vN1YAM+o/8E9VF0NyTy1:ga/Yi+l1YAMxkEc
MD5:	17C52CCADA0639FB4F04252FAEE37D90
SHA1:	12CFF8CFC1A263D1591E811AECD33417176F7A94
SHA-256:	B205ABC99B02631E3AAD2939538BA74DECFB5046313AF5097E0CB7322A5B8AFF
SHA-512:	B2F13805F78A00AA97F9572465BC6738A498473C09BE4CC28636E8814B5A0438EFB3E276F5AE9431FD0F6C6765482720E2D729950D28C1AA333AF96CC1182781
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.0536680532965885
Encrypted:	false
SSDEEP:	384:+GeV5W2hWfZSf+VIYi+v9KOAM+o/8E9VF0Ny+/U:+GeVXD/Yi+kOAMxkE0U
MD5:	FAB6D95D865549A6A86B9C707061022F
SHA1:	516E99A6369D563A4DD1BEA578D6E132E1B1ECEC
SHA-256:	760B39F051C4D92ED76AE28F07466497D31F0C3241BC9789D47D45D1F5752CB4
SHA-512:	2AADDD0B074C0E848456BCADB85E5300B5DEC748AC552CE6FACA5F9525DF0247C4CDB9DAAEEAD3D7037FDF6ABF572D8C7D94006D05C57B3FF2616B70ECFC43ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0.......#....`.........................................`................ ..................H/..............8............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.121965741620744
Encrypted:	false
SSDEEP:	384:byMvQW2hW6ZSf+VIYi+v7iAM+o/8E9VF0NybTI:byMv0k/Yi+DiAMxkEpI
MD5:	025C9739B8A2F67DD097EDF8E5EE5FA4
SHA1:	A9FA1D585E6768B42678FA9C120F7AC66236C66F
SHA-256:	7199313C9044BB1A64AB0CB0942742C8C366723D1B6EB0F21E88D8D778B0866E
SHA-512:	6B01BEF8A099C312A9613DA4D26DA73AF69D2C56CBE3B51C4A035580A85CC639A786A8963B47B79831E85E0318964DBADCC1C2FDBAC4ABF364E1BE2683B7F9EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0.......1....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17224
Entropy (8bit):	7.006431573619967
Encrypted:	false
SSDEEP:	384:+dv3V0dfpkXc0vVaOW2hWlZZSf+VIYi+v/AM+o/8E9VF0Nywn:+dv3VqpkXc0vVam2o/Yi+nAMxkE6
MD5:	3399C7976E3799FB90F06AE4A0B2D7D4
SHA1:	B423D4F018166614F1C85D15DDA282B4A441C971
SHA-256:	B7A0FB52B2344E26C71C0287AF8E794C3656D2226A661965152075C236453096
SHA-512:	710E4BDBB2FF7461AB6C530C3EB03C0B4A1C6DD4361618220578D11D3279DC48B3514BC60F34B37632A9F370BD41032D4803CE3D4D6C134E95298357758954D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......5.....`.........................................`...V............ ..................H/..............8............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.135495739355461
Encrypted:	false
SSDEEP:	384:LtZ3zW2hWCZSf+VIYi+vKHgAM+o/8E9VF0NyB3:Nc/Yi+CHgAMxkEf
MD5:	D6618210DBEB5B236D753AEBE1DC5502
SHA1:	9455ED2BB3D8A5A1DF678D343488780D46D1A556
SHA-256:	4E700FB8B8402FA260BA4A307FC424E02335FB9DF7F01BA43C0AB193E186C3CB
SHA-512:	655FA79A46F100B7A53A16DD30CE95C6904494F2FC40C357635DECA1D375AF4D7606DB33CFEFAD6F8F326A2C27A40C89FC44347E2B6B75624BAB1F677A14E5CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`...v............ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	7.0486111795203605
Encrypted:	false
SSDEEP:	384:lk+W2hWVZSf+VIYi+v5AM+o/8E9VF0NyKY83:lkWV/Yi+RAMxkEdS
MD5:	A26F26BF9FB90084F0AC198BAD558D33
SHA1:	E0D6E7BF044867529179A8A91AEE4AFFC7C0048D
SHA-256:	5A9108563BB24E7B30D0A29B4C549684F2AD8609E294618E03A1DF68D4FE06AC
SHA-512:	371728AAF3E5CDE66E020FF9CF70F1E3554E4594A7ED115CA89FF2B38C82BDCFF10B67D783FDC5E03D5B1CF804D56251D46479DFCF6AD3874F6F434ED2459F6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......h.....`.........................................`...E............ ..................H/..............8............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.1853302204609895
Encrypted:	false
SSDEEP:	384:3W2hWgpZSf+VIYi+vZnU+bNAM+o/8E9VF0NydXfpa:Jw/Yi+hzbNAMxkE3fpa
MD5:	E50986384AE58571B5A7CF60E87C586B
SHA1:	E4C3324957D9EF9DD93B7B118F824D6B9F649847
SHA-256:	E4134B8B9ED99612AB18F5DB7F594C840448F84294AE34E71D0C1DDF1253C041
SHA-512:	4EDB64E9FF76C4667BD1B16B084F89E869121428C9F5D4CD4883A2F72F895F655683733C5BD52E42C3D58EF240719A18C73FC2ACDE9206DA1C2828A1FAFAC33C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15176
Entropy (8bit):	7.071196431823014
Encrypted:	false
SSDEEP:	384:7W2hWzZSf+VIYi+vLAM+o/8E9VF0NypdltzKn6:Nb/Yi+DAMxkEdltm6
MD5:	D3C7E2A9CCAF398C8EA1F9A1E65B79DE
SHA1:	8617E572C860F9E9C06F5C178BFBEF9FEDAF3C48
SHA-256:	5048062D0A62CA0003FC55AF707A835AE6B9787B4D534CA7B675239198EAEE8D
SHA-512:	DE0FC1262FA6AB662F265A432C2F782EBAC7373945D6AEB7B0FB692BC8132E3C31E8A307178488D0D087C1681E00B56C3F946CFC0653D94042F0C4B211931F4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......l.....`.........................................`...9............ ..................H/..............8............................................................................rdata..L...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	7.072614562877752
Encrypted:	false
SSDEEP:	384:JLW2hWBZSf+VIYi+vTAM+o/8E9VF0NysEX9or:XB/Yi+LAMxkEPqr
MD5:	194D7C41DB65A418B67A88ED7DAEFDCF
SHA1:	633AAB57FFB52BA6C71E97F253DC0D7836565487
SHA-256:	421DF560744CE5D32265C1B746F2F737CA3DA21036CE695F071869223B706D2A
SHA-512:	7F8B6A2978C2830E998313C4A37EC2CABA2DAF923E71E3DDFB9A0922A87AB84EE8F9C34817BDF7C626F9D09D2CDA77AAC1A4A061FF1B59A5BD838DDD5D04F77A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19304
Entropy (8bit):	6.873658698941563
Encrypted:	false
SSDEEP:	384:EDynW2hW5aZSf+VIYi+vrWAM+o/8E9VF0NyAWq:R4h/Yi+TWAMxkEo
MD5:	CF0ECAF032CE8144E1FB239F149A613B
SHA1:	3CCCE3B665F94AA8369CCC24588A5E009AF863D4
SHA-256:	EAEC33C484B4A4F0729EED99383F4857A09A34A3D6D38BE0BC482F3D5A0AE1F6
SHA-512:	2DA0897918EDB7375E7038BB27CE040C1AC52093F237D84CA947CD94ECBDEC837507A482ECDB89608A081A635C6880A1370B9A90DFB4D39AA8E26CE9E2A42E85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................@............`.........................................`................0..................h/..............8............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.050276662317909
Encrypted:	false
SSDEEP:	192:s4WVghWCZSF8VG+VIYiYF8YGmFF8NUDQK2LM4A5K+o/y2sE9jBF0Ny3aq:FW2hWCZSf+VIYi+vQAM+o/8E9VF0NyKq
MD5:	0791F56B950D95FB3A7CB83F6ECADA69
SHA1:	671F76C862ACC74A7ACFE25167367DF494F1DF0B
SHA-256:	303DB02F8A4366009423ABAEB9FC17215C08662351479377446C0819CC4FA64E
SHA-512:	56EE86E255BB1B098A8F38C48999FB0433928284E9BAF80E394834FDEA403B415D92750AD1A85A062CF0AE75465984688730C5750A92BA436A49EA77460ADECC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......!.....`.........................................`..."............ ..................H/..............8............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17224
Entropy (8bit):	7.057780778316496
Encrypted:	false
SSDEEP:	384:j81nWm5C0W2hWOZSf+VIYi+veFAM+o/8E9VF0Ny710QWo:jOnWm5Co0/Yi+MAMxkEbWo
MD5:	B66C8091DDB2DAC21FDE217F77B74190
SHA1:	8AF014EE8FE6DF8D430939C73134D98B4211428A
SHA-256:	10695BB03F77548CD3F2995BDDDD0741074FC321C6B12A55555B7778F1395F26
SHA-512:	1A1E96A63B655AEF0098360822998A04624E1067A358594A6E1E881F3DFCFB327CBFCEAA554D9A02AF153E9C2A1A3EC456AC90DDA70BE9194A0B597A0F549C18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......4t....`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	7.025692345106523
Encrypted:	false
SSDEEP:	384:BfW2hWSPZSf+VIYi+vpoPAM+o/8E9VF0Ny30m:BBJu/Yi+h8AMxkEH
MD5:	23CAA73F109C23D7D076E221BA5CBB0F
SHA1:	E408483A3D0632C56D9679317FFB063121938A02
SHA-256:	2530A40B4406C51CE62290D88EA7F8B888117B267A81683CD2760E2C420395B5
SHA-512:	7B5BF9A0BB478065298CA521AAA0C438D20390F995E6E5995FE1C950814416D5091BAC2B7D3E76BF734A762533715D27A0D7365709AF5EE486266787F93138F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0.......4....`.........................................`................ ..................H/..............8............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.124895612907402
Encrypted:	false
SSDEEP:	384:o9kW2hW/ZSf+VIYi+vJnAM+o/8E9VF0NyGRm:xX/Yi+tAMxkEL
MD5:	A4A5A2AE83A93DAA7EA9DBFC9184770C
SHA1:	006C52B9C1CCFDFCC86A9DC0A8CC4B63E0AC1E98
SHA-256:	381FAD498508C6DD2D85CFD4429F392F8F60CE10F05B8638B2A6DC746F6915B5
SHA-512:	D7D695B4922A122329F470EBABA7B902C185EEA497119C7C573D5443DD577AC065C804F5BD2FE8CD0A3406663663F631863021FEF156F2BC1AB2AB5DC3DE63DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0...........`.........................................`...e............ ..................H/..............8............................................................................rdata..\|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24464
Entropy (8bit):	6.622004049321848
Encrypted:	false
SSDEEP:	384:uZVacWM4Oe59Ckb1hgmLtW2hW/ZSf+VIYi+vtAM+o/8E9VF0NyAQi:uZVJWMq59Bb1jbL/Yi+FAMxkEvi
MD5:	9AFE289C9E59D5C2272E207332724445
SHA1:	F06692007593A41ACD3888045826A6E5A1E50C4A
SHA-256:	2793538C731B35579F5AF4161EB26F532055111999BA844CF68E0599CCB0EED3
SHA-512:	CA222E2D1B4454522ECC608C928B311B08E1CFACAB3A1553A24B507BDE99A414A8D1126E38132300457D1BC7AD531DE7AB11481D9263134B9B5FB7AEF63F44A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........,...............................................P...........`.........................................`....%...........@...............0.../..............8............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67840
Entropy (8bit):	5.796015965728416
Encrypted:	false
SSDEEP:	1536:x5W2wDe5c4bFR2JyhcvxXWpD7d3334BkZn+PzUT/7xxs:nW2wDe5c4bFR2JyhcvxXWpD7d3334Bko
MD5:	76751F9E1DDDB8B7D496B816B4B169DE
SHA1:	8B25DFC6316520C63100DF6BDF76429E79A1C502
SHA-256:	5E6048E05217A42D3BB41D42C06EE28C1EF9B57BD072ECBFF399BD6A8C94D9F7
SHA-512:	2E3A25180603E3D6D05A4C10D0B3BF9D8B1A1E0DD7A39DE374292DF2041C3E65C1BC89CEBD92356EDC4A7C772CEF1B7FFA4EF7180F3DEF2EE657047839296056
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." ......................................................................`.........................................`....................................1..............8............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	7.0442150067750795
Encrypted:	false
SSDEEP:	384:WitIDW2hW/ZSf+VIYi+vXSrAM+o/8E9VF0NyXg+f:HmD/Yi+PSrAMxkEy+f
MD5:	798F4D27191E232954F6CC6EB12E37F4
SHA1:	7410AEB0DCE594B718DE6D237F641D432A51CE44
SHA-256:	F772B338306597F2372655058F6E712C94ACCFF6B45CA50217E4C37AB9D0AA89
SHA-512:	142F2F76BAE7FABCB785C6BC097D44EFD68B1D58270A2D21B6787FD8AF9B4DFF3986A6FF7A38101CB1760BEF36AB5E834B2444184D71C683A76EF42C76641248
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......'.....`.........................................`...x............ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19816
Entropy (8bit):	6.878251752186902
Encrypted:	false
SSDEEP:	384:G42r7eW2hW9DZSf+VIYi+vMAM+o/8E9VF0Ny+r:G42r72oa/Yi+kAMxkE4
MD5:	68170CF4EEB83B79048F075B7A51A955
SHA1:	63B78BECDE8933D9522FE76596F9BBB2A7621DAC
SHA-256:	A6D5CD23D1F27AC96DE0000D83139C3774B6262E94ECC1B2FA10B67F6BF67F74
SHA-512:	18937A2C3CCC4772595E36D39D127322A7B8FFB9AF1ECE50A11575C8B33D7EDE66332877D8D1B3AB5CB2397A839B26F21DFA7103A67DF73C4A7960698B2C3DFA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................@.......R....`.........................................`...4............0..................h/..............8............................................................................rdata..H...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21352
Entropy (8bit):	6.81505242835051
Encrypted:	false
SSDEEP:	384:a3vAmiFVhEW2hWxQMZSf+VIYi+vaiFF0CAM+o/8E9VF0NyDTv:4vYWAQr/Yi+Ci/VAMxkEBv
MD5:	ACA11EE61ECE2DBB62415BAF1F3B0AD0
SHA1:	0F3BC0E6484F8EB6D8865D672A3BE7E23A91E9D4
SHA-256:	FA0A7F056E3B823BF11233987B4EFC7416DD7B5ADD8E85AF453CDE0A82173289
SHA-512:	4BE4EF55BC57F50E21B112909EFE6DCECFDAFDB1A2C8FB47103C1895A0A365F0A55CD5DB0D79F0CE59C481501F54A1C91B789A6E535F73E5BC80A5B7E157A73B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." ......... ...............................................@.......^....`.........................................`...a............0...............$..h/..............8............................................................................rdata..t...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21352
Entropy (8bit):	6.7992459637859355
Encrypted:	false
SSDEEP:	384:47x0C5yguNvZ5VQgx3SbwA7yMVIkFGlHW2hWHIZSf+VIYi+v9AM+o/8E9VF0Nyx1:e5yguNvZ5VQgx3SbwA71IkFCyv/Yi+FX
MD5:	78999D34AA95B28A7783C1FA157B2A5E
SHA1:	B9C8B088AFB0DBCB5F5CE6275D95CAFBB07A1AEF
SHA-256:	8E04967378EF066A0B5FBF553B77A71B6EC02DA0890B69B9D056F8E653E8FED3
SHA-512:	407C9B56EDDFE7A6162CE3B25C877A7D1F4A145FCA52C43F832293A66AD9FDF9BFE766792281AF7DE6F7C7501BFEDDFC43F4F2D7F535EF4DD183C9549D111941
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." ......... ...............................................@.......N....`.........................................`................0...............$..h/..............8............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17736
Entropy (8bit):	6.9638123229593
Encrypted:	false
SSDEEP:	384:sPEzgW2hWJZSf+VIYi+vtAM+o/8E9VF0Nyq6:S0Ed/Yi+lAMxkEj
MD5:	989B803C46256C2B204EFAF56DF19834
SHA1:	705C221A504F0774E635B7EFA070B2BAD32AF98E
SHA-256:	13D8DFAF862BAD444BD0C9C8D24BCE7872821662E5A5F5BD8751E781A87B4DA1
SHA-512:	51C1FA464177563402A2D5C0D22A4EC56E25101B890B5C7DE58449AED43657E35D20D623EDF8F2B72DE26E217848595001AC9DC2557377345747189728A05D27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0............`.........................................`................ ..................H/..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15688
Entropy (8bit):	7.1166459203118215
Encrypted:	false
SSDEEP:	384:oBfKW2hWNZSf+VIYi+vStGAM+o/8E9VF0NyCDF:WfSd/Yi++GAMxkE0
MD5:	0C14577D5F2859CD44C1A4ECB7F58CF7
SHA1:	C699AD56D61A3ECE2D8645772F925DA184E69BDC
SHA-256:	B90AC711BE2675FAB5660A6619621589496528AE6C6E53D77E7B7684E4A18C84
SHA-512:	2D3C23573C147EFF3E610FD9AE6E768436888AB8DD8D6BF36CFD87D924CDAAADEA92A59E358AD1ACFAF57177B9777594DDA1D4E215E61636A330DBF6CAD488D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........................PE..d...48.U.........." .........................................................0......].....`.........................................`...^............ ..................H/..............8............................................................................rdata..t...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\base_library.zip

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880490
Entropy (8bit):	5.683224972553687
Encrypted:	false
SSDEEP:	12288:1EHYKmIBWSxC6S2cXPLA4a2YNyd1VwxffpE94pJSLMN6q:1EHYI1xyLa2SMVwxffpE940MN6q
MD5:	02A8CB875ED52CAAD5454EFA549A35BD
SHA1:	001675BFB6CA2E1D7E08D53005E20B49304D067A
SHA-256:	AD7635CC747083B9D7C9D37C8878A51DA167CC281DD85FB85B1E6B5C7C4E349F
SHA-512:	8738F91D32C3D63F047C3B5D3E9366B82E377245050EDDB146BD580FEBCCBB418B98F9FF48D57C7D672B65508E4E19B5482200A5FA5F1D227DDEE0AB8125C129
Malicious:	false
Preview:	PK..........!...PC............_collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI73362\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292541
Entropy (8bit):	6.048162209044241
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
MD5:	D3E74C9D33719C8AB162BAA4AE743B27
SHA1:	EE32F2CCD4BC56CA68441A02BF33E32DC6205C2B
SHA-256:	7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
SHA-512:	E0FB35D6901A6DEBBF48A0655E2AA1040700EB5166E732AE2617E89EF5E6869E8DDD5C7875FA83F31D447D4ABC3DB14BFFD29600C9AF725D9B03F03363469B4C
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.675182011095312
Encrypted:	false
SSDEEP:	96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5:	F33CA57D413E6B5313272FA54DBC8BAA
SHA1:	4E0CABE7D38FE8D649A0A497ED18D4D1CA5F4C44
SHA-256:	9B3D70922DCFAEB02812AFA9030A40433B9D2B58BCF088781F9AB68A74D20664
SHA-512:	F17C06F4202B6EDBB66660D68FF938D4F75B411F9FAB48636C3575E42ABAAB6464D66CB57BCE7F84E8E2B5755B6EF757A820A50C13DD5F85FAA63CD553D3FF32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..^W..^W..^W..W/..\W..K(..\W.../..\W..K(..UW..K(..VW..K(..]W.."..]W..^W..xW..g.._W..g.._W..g.a._W..g.._W..Rich^W..........PE..d....hAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.879886869577473
Encrypted:	false
SSDEEP:	3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5:	494F5B9ADC1CFB7FDB919C9B1AF346E1
SHA1:	4A5FDDD47812D19948585390F76D5435C4220E6B
SHA-256:	AD9BCC0DE6815516DFDE91BB2E477F8FB5F099D7F5511D0F54B50FA77B721051
SHA-512:	2C0D68DA196075EA30D97B5FD853C673E28949DF2B6BF005AE72FD8B60A0C036F18103C5DE662CAC63BAAEF740B65B4ED2394FCD2E6DA4DFCFBEEF5B64DAB794
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SRxr.Rxr.Rxr.[...Zxr.G.s.Pxr...s.Pxr.G.w._xr.G.v.Zxr.G.q.Qxr...s.Qxr.Rxs..xr.k.z.Sxr.k.r.Sxr.k...Sxr.k.p.Sxr.RichRxr.........................PE..d....hAe.........." ...%............02....................................... ............`.............................................d..........................................Px...............................w..@............@...............................text...X-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\init.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6793
Entropy (8bit):	4.966446669677776
Encrypted:	false
SSDEEP:	96:cHqnQbu/3aOjcEYIL9GE6AUmZris46/B5aVOQOo2/nH/h5M966GMBWtReWE3uSI3:2qQYaOjIKtc6/Bb/H/h2BWtc93k
MD5:	6F043AFF1EDD20D3C9D6398F936FBF58
SHA1:	7149D2D20E1EB8C10C5D2BDB8EDA23551FC82650
SHA-256:	957A91BFD98FFB07A10CD789B7C5C46806568476B61E34C7AD56A00092B981A5
SHA-512:	7358DBA479899DBC3AFB955903820D2A7A54B9C398BF5D4565C8DC044241821EDD621D7416862AF396DB4216373B1E8AAC00EB78046FCC3CC2396AA02CD6947B
Malicious:	false
Preview:	'''..OpenCV Python binary extension loader..'''..import os..import importlib..import sys....__all__ = []....try:.. import numpy.. import numpy.core.multiarray..except ImportError:.. print('OpenCV bindings requires "numpy" package.').. print('Install it via command:').. print(' pip install numpy').. raise....# TODO..# is_x64 = sys.maxsize > 2**32......def __load_extra_py_code_for_module(base, name, enable_debug_print=False):.. module_name = "{}.{}".format(__name__, name).. export_module_name = "{}.{}".format(base, name).. native_module = sys.modules.pop(module_name, None).. try:.. py_module = importlib.import_module(module_name).. except ImportError as err:.. if enable_debug_print:.. print("Can't load Python code for module:", module_name,.. ". Reason:", err).. # Extension doesn't contain extra py code.. return False.... if base in sys.modules and not hasattr(sys.modules[base], name):..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\config-3.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	748
Entropy (8bit):	5.110506159030977
Encrypted:	false
SSDEEP:	12:WSolITEO+RNIdjcFMlYFXe2LirYKMLFxAe5bHMnQBwmuTD9+sXWeZKMLFxAe5biw:MlY+34jamr0L7Ae5oJP9+oJL7Ae5mU9L
MD5:	E8ED8F25854821C8910BCB8308507DCE
SHA1:	8A3AC32D3DF44794E8A834A6B6A8A1ED3F3AA5F7
SHA-256:	DE28C7B5213CCA148F09469916584611B3D66C1C8C432880259D6A3A92380213
SHA-512:	F3F36EDF288A870F5E1F14F3B1113031721E12F30BF235B0E5385711E2BF7F08D0123E6AB14600AB069D2E692D81B7ABC3692FB69EED34374FEFAB3B24F03D86
Malicious:	false
Preview:	PYTHON_EXTENSIONS_PATHS = [.. LOADER_DIR..] + PYTHON_EXTENSIONS_PATHS....ci_and_not_headless = False....try:.. from .version import ci_build, headless.... ci_and_not_headless = ci_build and not headless..except:.. pass....# the Qt plugin is included currently only in the pre-built wheels..if sys.platform.startswith("linux") and ci_and_not_headless:.. os.environ["QT_QPA_PLATFORM_PLUGIN_PATH"] = os.path.join(.. os.path.dirname(os.path.abspath(__file__)), "qt", "plugins".. )....# Qt will throw warning on Linux if fonts are not found..if sys.platform.startswith("linux") and ci_and_not_headless:.. os.environ["QT_QPA_FONTDIR"] = os.path.join(.. os.path.dirname(os.path.abspath(__file__)), "qt", "fonts".. )..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\config.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	123
Entropy (8bit):	5.165836377533827
Encrypted:	false
SSDEEP:	3:JSxrsr+A6+Ei7/erj5Erj+7IE3KTY5O8nkz6+Eov:arsrFEoidAM3Kk5PkBEy
MD5:	FCB98FFC6E408D714FC0E0555B1FB530
SHA1:	832A187368BED379942A0A6EF77D8057166DF7F6
SHA-256:	D9E401B9A67304D69C48A494A485D106B534E02BF5776211C09F09BD671B295D
SHA-512:	C679EB68F62D4D4361FB55BE7B052FCD3AD85BFF9DFE9ED27AFD7014C992F26851BF02E7A587AA411D08593C69A197603FAD685E976D2948F35240D5F87DC3F8
Malicious:	false
Preview:	import os....BINARIES_PATHS = [.. os.path.join(os.path.join(LOADER_DIR, '../../'), 'x64/vc14/bin')..] + BINARIES_PATHS..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\cv2.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74452480
Entropy (8bit):	6.688458431409654
Encrypted:	false
SSDEEP:	393216:R6j4+mite1TViOawuRCeRiLq1lAfNRHJ/ZxvtmmLiAUwkRifDPVH:RZF1NT9
MD5:	901871C3AB330E0C3070226349EEC860
SHA1:	C07EAB479E0475B0992CDC99D9123981FB06777B
SHA-256:	A73AEB87DC1B2F6CD6E978B653E89604F09BE4B9531573020695CB48EB998E8A
SHA-512:	F45F8F22F552F23092691616E38D6F9AEC01D020C51F4D8B0FDD64FEB45D04135276D967BCD1C102408B757AF25F82F4194F85F8D4A0A3EAEED44ABABB34861C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......k)../H../H../H..B...cH..B...0H..B...H...?.H.....aH.....VH......H..B...H..u.5.~K../H..k..B...3H.....=I..=..,H../H..YI......J......H......H......H..Rich/H..........PE..d....{pf.........." ......L..&5.............................................@............`..........................................UC.d1..D.E.@............pc.................H......T......................(...P.................L.(............................text....P6......R6................. ..`IPPCODE.>B...p6..D...V6............. ..`.rdata........L.......L.............@..@.data........E.......E.............@....pdata.......pc.......Q.............@..@.tls.........p}.......k.............@...IPPDATA..M....}..N....k.............@....gfids..h.....}.......k.............@..@_RDATA........}.......k.............@..@.rsrc.................m.............@..@.reloc..H.............m.........

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\data\init.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.5164686969838375
Encrypted:	false
SSDEEP:	3:JSxrGSCcurj5ErAwGfnJFB:arGSLSdAAb
MD5:	734F2F32C81B5CEDE1098394DAB581B5
SHA1:	E07450D3F1924078DD09E0B1DEA8DD671DFE8801
SHA-256:	F4CE16721ED7F623A4DCC443BA600D1856DB610CB2C3D53C13A8CA028CC68F6D
SHA-512:	C0C9ADD6A1CD47F34C91B12AD369E887CFD28859824D258E1EED0C3495378DD950E214F8A540D66CD555ED8EFC810418DF3F13E09765D24D6FA26B09B44857C0
Malicious:	false
Preview:	import os....haarcascades = os.path.join(os.path.dirname(__file__), "")..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\gapi\init.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10621
Entropy (8bit):	4.717526275196451
Encrypted:	false
SSDEEP:	192:mIntUjnLP6P7B4D7BP7Bb7BewmDraPt0C2Vqed/:m2eBNYraPt0C2V9Z
MD5:	3A4D80801F49E3A13903811C9E59018A
SHA1:	0227B9F1FB7E900777BD8951404075DF2D6D3447
SHA-256:	74F5FD2A142A31B0A4707B70C0BE3637F0FBF8A940EEC4372E7BA87E5A5CEDB8
SHA-512:	F79D2C216008FE8EC1F9C28575776C81B5FAC63B18996803B76B73EAF088800FE4E46B4C18F7CE9730177549FD5402421719FA2B8FFED73EE60EBACAE4D5CCB1
Malicious:	false
Preview:	__all__ = ['op', 'kernel']....import sys..import cv2 as cv....# NB: Register function in specific module..def register(mname):.. def parameterized(func):.. sys.modules[mname].__dict__[func.__name__] = func.. return func.. return parameterized......@register('cv2.gapi')..def networks(args):.. return cv.gapi_GNetPackage(list(map(cv.detail.strip, args)))......@register('cv2.gapi')..def compile_args(args):.. return list(map(cv.GCompileArg, args))......@register('cv2')..def GIn(args):.. return [args]......@register('cv2')..def GOut(args):.. return [args]......@register('cv2')..def gin(args):.. return [args]......@register('cv2.gapi')..def descr_of(args):.. return [args]......@register('cv2')..class GOpaque():.. # NB: Inheritance from c++ class cause segfault... # So just aggregate cv.GOpaqueT instead of inheritance.. def __new__(cls, argtype):.. return cv.GOpaqueT(argtype).... class Bool():.. def __new__(self):..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\load_config_py3.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.627093215673309
Encrypted:	false
SSDEEP:	6:SoSvYFyMXS/qdadew7mZ6ALNCpvdYZ4un:kUFuT7mZlCpFw4u
MD5:	EED4002FFE913424133D8F19FDF1C2A8
SHA1:	F232D4C5ACF73885D8E0D70418FB2E1481D9271B
SHA-256:	FF583A5874BE8F848E73C2F61B3A71680995926479C9BC436E6565C5CCE7CA07
SHA-512:	115F32B21E99DEC9B50C766CC685F9387A0D0C1611A41540CA23B71579E2963E04A1E940C6C8F3447A26006DBC45F17013A7FFE97BE620B74F1CF20A21505B8E
Malicious:	false
Preview:	# flake8: noqa..import os..import sys....if sys.version_info[:2] >= (3, 0):.. def exec_file_wrapper(fpath, g_vars, l_vars):.. with open(fpath) as f:.. code = compile(f.read(), os.path.basename(fpath), 'exec').. exec(code, g_vars, l_vars)..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\mat_wrapper\init.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.96613832345308
Encrypted:	false
SSDEEP:	24:7TYCO610sctIsPo5k/1i0N0QhKNAhno3oBoIVbOXono6RnZB:gKceCzN0QhKNuniM5iC/r
MD5:	8A38C1B85454BB467D3BE71BC0EE3486
SHA1:	0D4A8B9B136E3A123D3BC38B484086C8AF07A15A
SHA-256:	C44707EA1C76F35518AE572B6C1989D76C2ADA7E850432E41805DFE112D4E306
SHA-512:	94F6E6E8F5CA41677F69487B8C8EF8C2C004250524ECBD46D1407DA47ABEC05D54A765D79E1633EAECF5A3F9815B7A4604E674D6020442A72BC038FECD93DDFA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	__all__ = []....import numpy as np..import cv2 as cv..from typing import TYPE_CHECKING, Any....# Same as cv2.typing.NumPyArrayNumeric, but avoids circular dependencies..if TYPE_CHECKING:.. _NumPyArrayNumeric = np.ndarray[Any, np.dtype[np.integer[Any] \| np.floating[Any]]]..else:.. _NumPyArrayNumeric = np.ndarray....# NumPy documentation: https://numpy.org/doc/stable/user/basics.subclassing.html......class Mat(_NumPyArrayNumeric):.. '''.. cv.Mat wrapper for numpy array..... Stores extra metadata information how to interpret and process of numpy array for underlying C++ code... '''.... def __new__(cls, arr, kwargs):.. obj = arr.view(Mat).. return obj.... def __init__(self, arr, kwargs):.. self.wrap_channels = kwargs.pop('wrap_channels', getattr(arr, 'wrap_channels', False)).. if len(kwargs) > 0:.. raise TypeError('Unknown parameters: {}'.format(repr(kwargs))).... def __array_finalize__(self, obj):.. if obj is Non

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\misc\init.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.968211974414884
Encrypted:	false
SSDEEP:	3:1LT2QbQNQ4yL9v:1LT2Q8NQ4yJ
MD5:	C6B0244719659C5EDEC0592AF112032A
SHA1:	6BD926FE0C853A9938BDB5D9537BD88FD1EF5401
SHA-256:	495BD79594CCE174673E372C85C4DD8F4FFDF2B3A73FD4623955B0D55DE0D462
SHA-512:	28D80015309AC1AE19F048E9461D4D04B85CE16B9E68C58D7608351A39B8D3EC0235FCCFD928B0349082C702D890B6C6ABD36B8030A176BF05888AE8C493B545
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	from .version import get_ocv_version..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\misc\version.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.525707419533802
Encrypted:	false
SSDEEP:	3:JS4iydoKE4yLYfg+4zxNG364yLA9E5HJwv:mIXE4y0YpE6405pwv
MD5:	2D3125F1843A670B9F3229A7BC362816
SHA1:	E884BC3D05E5E732D1308DE67AA5F96BBF4FC69F
SHA-256:	C93A418793FCB15B9B4316C0741B8336740E490E94F3B7D1EBE8CD5F6F23815C
SHA-512:	BFDCF6BFC1D82E3ACAF625B5940CA169784427712F14895FD6CA92CC9C864F1A894FECF97BF2AFA6FC5CF4ABA9738A302D30024BC192F85025989C0D93A8B540
Malicious:	false
Preview:	import cv2......def get_ocv_version():.. return getattr(cv2, "__version__", "unavailable")..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\opencv_videoio_ffmpeg4100_64.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	26391552
Entropy (8bit):	6.593432194938545
Encrypted:	false
SSDEEP:	196608:UQJqLjUxo5PA5MQrrrCyBOuqmWA2EYO8GTkTN/3Ogq2fxSo0U1T:UrPUxoqMQrrruuqt094hvOgq25p0aT
MD5:	BFEF029900F788480A363D6DC05C4F0E
SHA1:	F61AC0F8E6BF1B699698EC9DC94F9088F7C202AE
SHA-256:	3DE83B84588B3EE8BACDBEA85A8F92D4855A32A1108183963315A7DB06AD5744
SHA-512:	83046ABDB5252B831D2D683707BCF3007A1CDC84FB3AB56428507398EC1B9D3A5EC2877B36204B485CAACC407AA22C61FBDE85118F5CCF5DF0B04FFC5D651166
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...".2B......n..P..........p............................................. .............................................. ..p...p..8....0...............................................>..(...................L...............................text...p1B......2B.................`.P`.data........PB......6B.............@.`..rdata..0.>.. G...>...G.............@..@.rodata...... ......................@.P@.pdata.......0......................@.0@.xdata.............................@.0@.bss....`m............................`..edata...............h..............@.0@.idata..p*... ...,...j..............@.0..CRT....`....P......................@.@..tls.........`......................@.@..rsrc...8....p......................@.0..reloc..............................@.0B........................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\typing\init.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5434
Entropy (8bit):	5.152336645688798
Encrypted:	false
SSDEEP:	96:cuACTXc/yidAKdpJUiA7VDpHGN5RME0Kdc:cKzji+KsRcRME0N
MD5:	BAD2104D74F1DAF8E79AC3BC0FA5A3B1
SHA1:	F9D2CAFE013C5A3938487065F598515FC2B3FA17
SHA-256:	9DE1E504724D2FF1CFF305E7EFDD8D09A8D636734149AA4AF9DDF406975119B9
SHA-512:	0098F8A91A365D927BA5B25C5B07859B800F0AF876AE43D56685CF839C53E8CD115F34303B897310CA86980D1543F5A40C15BD784F81169AAC42B1E9A0AC2956
Malicious:	false
Preview:	__all__ = [.. "IntPointer",.. "MatLike",.. "MatShape",.. "Size",.. "Size2f",.. "Scalar",.. "Point",.. "Point2i",.. "Point2f",.. "Point2d",.. "Point3i",.. "Point3f",.. "Point3d",.. "Range",.. "Rect",.. "Rect2i",.. "Rect2f",.. "Rect2d",.. "Moments",.. "RotatedRect",.. "TermCriteria",.. "Vec2i",.. "Vec2f",.. "Vec2d",.. "Vec3i",.. "Vec3f",.. "Vec3d",.. "Vec4i",.. "Vec4f",.. "Vec4d",.. "Vec6f",.. "FeatureDetector",.. "DescriptorExtractor",.. "FeatureExtractor",.. "GProtoArg",.. "GProtoInputArgs",.. "GProtoOutputArgs",.. "GRunArg",.. "GOptRunArg",.. "GMetaArg",.. "Prim",.. "Matx33f",.. "Matx33d",.. "Matx44f",.. "Matx44d",.. "GTypeInfo",.. "ExtractArgsCallback",.. "ExtractMetaCallback",.. "LayerId",.. "IndexParams",.. "SearchParams",.. "map_string_and_string",.. "map_string_and_int",.. "map_string_and_vector_size_t",.. "map_string

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\utils\init.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.438685267245838
Encrypted:	false
SSDEEP:	6:1zBhJDyTH2XE2OTH2XRxEMGMBrMhWcROEoiZAIfH2Xc10F9vSumHcROEoiZWf:1zBHyLkOLejrMYccRIfh0FNSfcct
MD5:	952D77A31C0171AE90C0086AA8E3FCC7
SHA1:	000D22FD5A2545CEFBBF294D63415E82E232820A
SHA-256:	2B16990B35B569AF1CA7239DC10F7B24EC62F27A46626B1E2F1271D2E1AA3554
SHA-512:	36E5BEA12CDF8AE29D737F7062923AE4A1DBDB2C98904F9A35559222119FAFA836C4A7553F5CD9F5639043183155F5E93DFE731EBCF385349A8E4CA72D2E92B6
Malicious:	false
Preview:	from collections import namedtuple....import cv2......NativeMethodPatchedResult = namedtuple("NativeMethodPatchedResult",.. ("py", "native"))......def testOverwriteNativeMethod(arg):.. return NativeMethodPatchedResult(.. arg + 1,.. cv2.utils._native.testOverwriteNativeMethod(arg).. )..

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\version.py

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.601309915764778
Encrypted:	false
SSDEEP:	3:K2T2QxVLVLLyJRi+gI/aIysi+gIgZPGXV:K2TbTh6JvgMaDR1CV
MD5:	11D506AD07970539A2069E87F488C60E
SHA1:	ECFC23D272E8871943594CDB6A6A9FA6651BCAF9
SHA-256:	1DE383F5662831E69BDDDC21F9D1E4A2A8E806F57F7F69669103DF64D5DB4083
SHA-512:	8E74CFFD8064A6B1406AE250E81F93E6F4860FA72F63E7E0A0AF6F7261327ACD6F0C30B5C0C9DECE33E1481E1774968C8FAA85C52416D114C713DF681EB791AC
Malicious:	false
Preview:	opencv_version = "4.10.0.84"..contrib = False..headless = False..rolling = False..ci_build = True

C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4775
Entropy (8bit):	5.023071655293457
Encrypted:	false
SSDEEP:	96:DxDZSaC+wzmnEh2S8xIR9026eLQ9/4nzc+fFZpDN00x2jZ2SBXZJSwTE:qzKnEh2zxIf026mQ9/4ng+TP0vJHJSw4
MD5:	1561127B96DA63642D7A9BCDFD5F3600
SHA1:	01C697FF4CEB61732F58217A1ABFB315E0FF8708
SHA-256:	1D78A40E966EB78AD8D83E19BA10315E72D40DBF9FFD73FF0B2A7D898985E06D
SHA-512:	B0D7D648A8EF5D0789440B793E47539DF21B322AD6C879CAC5E8CC8C36C4D4AB1016971519F462923F8B1747641D441F8AA841113DF96F131C9E0DC28E125ECE
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.5.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=3.20.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: check.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'check'.Requires-Dist: pytest-ruff >=0.2.1 ; (sys_platform != "cygwin") and extra == 'check'.Provides-Extra: cover.Requires-Dist: pytest-cov ; extra == 'cover'.Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3

C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2419
Entropy (8bit):	5.615810763784891
Encrypted:	false
SSDEEP:	48:NxnuXkx5xzxNxejRxl/ghXV5XzS9pv9jf4whf0s0XBfnJ/VaXJnzN/3WJV:NUXk7xbIRPgBDzSD9jn0s0XBfJ/sXNzc
MD5:	E9C7F89FF6E4B6FE5247A67F22BBABCD
SHA1:	D50D29C8360CD27839C34F3D28E810531CFF5766
SHA-256:	2D95184CA61F14F3B0756E57F963D3EDF66D5F5B88EC8F5829EF3A679D1780F4
SHA-512:	E7502260D07842CE32744DE3FB7359253703CF136C7CEAE38766346076E73F95BB8C3D866179162FD58CC033A98CD9FBD14E66DFA040D47CADB2545E0CD43D0F
Malicious:	false
Preview:	importlib_metadata-8.5.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.5.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.5.0.dist-info/METADATA,sha256=HXikDpZut4rY2D4ZuhAxXnLUDb-f_XP_Cyp9iYmF4G0,4775..importlib_metadata-8.5.0.dist-info/RECORD,,..importlib_metadata-8.5.0.dist-info/WHEEL,sha256=cVxcB9AmuTcXqmwrtPhNK88dr7IR_b6qagTj0UvIEbY,91..importlib_metadata-8.5.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=-Sk7aVqfmzLecdjSOpLKo1P_PegQanR__HsMMyEq0PI,35853..importlib_metadata/__pycache__/__init__.cpython-310.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-310.pyc,,..importlib_metadata/__pycache__/_collections.cpython-310.pyc,,..importlib_metadata/__pycache__/_compat.cpython-310.pyc,,..importlib_metadata/__pycache__/_functools.cpython-310.pyc,,..importlib_metadata/__pycache__/_itertools.cpython-310.pyc,,..imp

C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.740122087202446
Encrypted:	false
SSDEEP:	3:RtEeXMRYFARLkM5jP+tPCCfA5S:RtC1RLkAWBBf
MD5:	1659D01495817C8CFA161658CFF5FB4C
SHA1:	0E9A0F7C2DE9BB7EAAB715E32A8B908C6ABA16CD
SHA-256:	715C5C07D026B93717AA6C2BB4F84D2BCF1DAFB211FDBEAA6A04E3D14BC811B6
SHA-512:	68F2D504DCD752370CF59DE1D00136B84C2C150A8BEAA615BACCD5316EEF9C51A27226973BD0B6B4045F7D6163BBFC7EB16D16C05D79D9A910A997C494991382
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (74.1.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI73362\importlib_metadata-8.5.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI73362\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy.libs\libscipy_openblas64_-fb1711452d4d8cee9f276fd1449ee5c7.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38327135
Entropy (8bit):	6.307984710026116
Encrypted:	false
SSDEEP:	196608:fR/mZHTnk72SQolnY4s3oAeO0fEQg55OzPWp4I/LOzPWPQY+uOzPWlALcd7UeRBZ:foOzPWZOzPWnOzPWF56g3DMy
MD5:	6228837855E10997AD5CFA204AAEB620
SHA1:	23EC44B63A8203CAC64180D044BA0CE2E5BAAFEE
SHA-256:	39E80D3D5FD1E998CB7C5C7B5D54136AF75A688DFA6C38470E8BF89B01EEC134
SHA-512:	1364A21BBACC2A2FC688EBA7A998631050A75566B950C10320468B51D9660C18B881C9BBE1AF1CA1EE4F86238C6E85FD4516435FECF1A606AFEA931DC59B25D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...es f..........& ...$.$..........P..............................................7\I...`... .........................................DO.......................$...........@...V..............................(...................\|...P............................text...X#.......$..................`..`.data....,...@.......*..............@.`..rdata...\...p...^...X..............@.p@.pdata...$.......&..................@.0@.xdata..p#.......$..................@.0@.bss.....~...0........................`..edata..DO.......P..................@.0@.idata...............P..............@.0..CRT....`.... .......j..............@.@..tls.........0.......l..............@.@..reloc...V...@...X...n..............@.0B/4...... ...........................@.PB/19.....Y...........................@..B/31......_.......`..................@..B/45.................................@..B/57.....

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy.libs\msvcp140-8021418012832a07a8ca5105a33b1086.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	621960
Entropy (8bit):	6.343728403524803
Encrypted:	false
SSDEEP:	12288:WO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFR:F3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOE
MD5:	EC84E4662E892982A726C3742547B64E
SHA1:	7EBF56E97E586C05ACFFAB4375A38C906D3F3D9E
SHA-256:	85448E376DFAD1859740AEDAA2544B565E8A6E4E2E555DE6C4638F4AB1B28843
SHA-512:	837E4127F5AEF404D75155C207ED8AAF1573793869453E3FF8E615B5EE06851B005F61B9071D40E820B493FE3D3BE202B87D0BE464765943241A07269DF20C82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..r$..!$..!$..!.O.!&..!-.\|!2..!v.. '..!$..!...!v.. '..!v.. o..!v.. j..!v.. %..!v..!%..!v.. %..!Rich$..!................PE..d.....0].........." .........`...... .....................................................`A............................................h....................0..t@...T...)..............8............................................ ..........@....................text...<........................... ..`.rdata..<.... ......................@..@.data....;..........................@....pdata..t@...0...B..................@..@.didat..h............B..............@....rsrc................D..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\_core\_multiarray_tests.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	6.006603257080014
Encrypted:	false
SSDEEP:	768:XfnO7cpmwoLtyPEekN0o87S235WdiwtvngPWFl3+lxJk2gSWQEKiTG:XfnCcroLheF13ItvgPWF1+zJunfKiTG
MD5:	473AAE5A648AC29DE839ED277E10F9A9
SHA1:	E8440743E632CD78924FBAC6F4008F1433C25B48
SHA-256:	3B3A7B3C1381D14EAEA388BD239327642D9ECD1DF78CDE984B2988399A415FC2
SHA-512:	E391403EDCE8ED43323F77C79DCCC828243B720B1530B846E1B5660E3E54F1CF565ADFACA02903DF00A4F8B2F7640CB957DD84E428BA1EB8C9FB8097301ABD4A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........P...... ........................................0......z.....`......................................... ...........................\|............ ..l...................................0...8...............(............................text............................... .P`.rdata..L7.......8..................@.P@.data...............................@.P..pdata..\|...........................@.0@.reloc..l.... ......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\_core\_multiarray_umath.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3909120
Entropy (8bit):	6.742275175450814
Encrypted:	false
SSDEEP:	49152:TEfea1mpOyN1XSGwqx2VKYESBUwHOoeiaI+D0f0sMJHJ24/JJ2zm8e6G:pLXESmcEOxiaDHJHJozm8eV
MD5:	5AE5141FDF3B6D534ED3E28571565639
SHA1:	6A84E6AC5949A61541CBA4E78DF5932E5222DEFA
SHA-256:	25DAE6A5B4A5CDB673C8C9BD246B256638A8CE70C0E760449392CD30F0CF9B37
SHA-512:	CAD7F00A7E88636BF367AA86F71CCDCFFCDDC3C5A461584C59145546E642B67B364A956153CC42BC94FA2E540BDBE8BEB092A9B41A48514DFF23403F4647437F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."....../.........4./.......................................=.....8t<...`.........................................pD7.t....D7.@.............;.X.............=..#...05............................. 15.8............./.8............................text...../......./................. .P`.rdata......../......./.............@.P@.data....E....7..F...n7.............@.P..pdata..X.....;.......9.............@.0@.reloc...#....=..$....;.............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\fft\_pocketfft_umath.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	279040
Entropy (8bit):	6.2227770439911065
Encrypted:	false
SSDEEP:	6144:SxLgf3r+IIOpErYAWPo3Wp0KPbnG3ucZTRLk7rEiFF2U+g3k0b5fW:Sxy+IIpcAx3AG3ucZTVc0Kb
MD5:	59D9EFA7ABFCA81AEA359E5278681C35
SHA1:	94EED0155C45F47F0C7E5749A1F8EB0A31527B56
SHA-256:	1F47BED8475CBAC75C3E23B1B51BD51458EA9C0454DFA90315C535A19117A4F8
SHA-512:	6E056EA7BD52871A048C6FE24D0E68AA5C4CF6D2D475E7B732F99643CE70CACA02C324A4188750A9D89DB256072CE890AFF27B446A9A5B5359293455B987E2CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........R...............................................p............`..........................................0..p....1...............P..X............`..........................................8............................................text...B........................... .P`.rdata..D9.......:..................@.P@.data...H....@.......,..............@.P..pdata..X....P.......0..............@.0@.reloc.......`.......@..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\linalg\_umath_linalg.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.287444465344144
Encrypted:	false
SSDEEP:	3072:wo0ZnBat4PLh4vgZurreOJv6Z8inorUU:wZZBaOPLhK39ASGoA
MD5:	3C6787A5AB86556C75F13B88719BE23A
SHA1:	755BE629C31462971987B500049D800EE6DB3F24
SHA-256:	F899BB2DDDB8A955B897FCF56D82EC8FB0BC35C92DF36FB1E5FCE70913E1BCAF
SHA-512:	0B3F80DC72F24DD70F98ADF0FE128685885489D44796833FC106137FFC4576EF3F41CCD1F3084BE975D576B50A6915609A7C1B3C67B22318D3C2942CC43FE09F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....R...X.......U....................................................`.............................................l...l...................p.......................................................8............p..@............................text...xP.......R.................. .P`.rdata..B8...p...:...V..............@.P@.data...............................@.P..pdata..p...........................@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_bounded_integers.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	253952
Entropy (8bit):	6.393623545364222
Encrypted:	false
SSDEEP:	6144:3kPONhlIwxNBbD4b07eNsU92DmdWRR8/fRl0Zk8lT0rj44o9yeycjwTULqPw:IWnnBP4MDmd8RWfR2xQEUcjwA
MD5:	BEAD02698FFB236CBF467A3065D23234
SHA1:	3EDA671457C8A17C5C550A96A4C2AF44E4C3D642
SHA-256:	F6DBE6AB95B5D36DD349907D24CCBB5036FE3AF8DC0CA7F555F9EF89ADBCAC23
SHA-512:	AAA4E601CEF5EBC681A225F126258AF18BD3EEB9C6007BE6D6F972DFF31BA06274DFC35CEA0ACE2E550D7D22DB081AABD680CB865A7F5C295FF595781C651C7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...............p-....................................... ......1.....`............................................. ...0...x...............................P......................................8............@...............................text...h(......................... .P`.rdata..2....@......................@.P@.data...............................@.P..pdata..............................@.0@.reloc..P...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_common.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	176640
Entropy (8bit):	6.090861556219245
Encrypted:	false
SSDEEP:	3072:GpbOgSqywiNgj17FzxYD6kBOpPjc6IWJBPyer4zh0la2m4P92y/MvR64fK2yuP:GlOgjywZxlYD6kBOFw9Wjq8Az4F2kkKy
MD5:	B653795FF45A164C366E88A629A27063
SHA1:	37905E8F1A346F65C7C63267A961BF1CCB95129D
SHA-256:	826F5B677E7AEF495CDF39C4963D20CB3AE210A6B70736C6A65E54DA0572367D
SHA-512:	033753352C2061469A79C6E0E0731F3E1DCDA7833B87DEEE459C2A93E9253BBDB4BEDDA378E3E74905480EA09F024876092D7EA7EFF869D5AB1CBCE6AEDF93D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....@...n.......D..............................................wK....`............................................`...0...x...................................................................0...8............P...............................text....>.......@.................. .P`.rdata..\X...P...Z...D..............@.P@.data...............................@.P..pdata..............................@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_generator.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	754176
Entropy (8bit):	6.308341073649681
Encrypted:	false
SSDEEP:	12288:vgKLJ4m3XMqQzfKwwoeV6CSuBEfU/3FgUShxP3txEKbjw1CjOAP:vgKNv3XMZzfK77IfaqUS4K3Xl
MD5:	80CF0AF897C58D281FDD65B8C62EB023
SHA1:	AB9993DD8589831822317DB9665022F8F392C736
SHA-256:	97F0EB93472D4EEA959658259D1D74B6429B4231717701833C196241E6FFDA0F
SHA-512:	4D0F7C5478FD73B1B164254B0DB4EA28E0A4B0A91470E5A6F5269786D48604FED4E4678E9F21DD4C8D9717A942B709999FD249271E8ADCA02FE07FC7E573D195
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."................P................................................n....`..........................................%......<...................<...................`...................................8............................................text...X........................... .P`.rdata...Y.......Z..................@.P@.data...XN...P..."...<..............@.P..pdata..<........ ...^..............@.0@.reloc...............~..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_mt19937.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.120849934817026
Encrypted:	false
SSDEEP:	1536:cPU6Nwc4EvXXrZc+SoZnePRnfFqo4zPdiTWD6mcmdeiQ3zPdeYp4DrD7H:cMmJ4EvnrZowe5nfFh4z8T1iQ3zsYp4v
MD5:	37D4A602C81286FD834C374B59A02EA4
SHA1:	5FB37DC6A6BF1234072DCDE64916F983025C484E
SHA-256:	DF2000932009BDA58F76A6AEE3241D35379C34F4DC491DE95C8011537944CFE1
SHA-512:	A3E79A10A1EC202E2CD84C6D9B27A0A7DAB4BF5F1E0E64EC7EE5369B3714546C89DB87884B7438C9C62A3754480FDFBC7E2601E23E202465FE67E9C7D5EE410D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........x............................................................`......................................... >..`....>..x...............L...................p1...............................1..8...............@............................text...H........................... .P`.rdata...a.......b..................@.P@.data........`.......F..............@.P..pdata..L............P..............@.0@.reloc...............Z..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_pcg64.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	6.018931764024151
Encrypted:	false
SSDEEP:	1536:v2iEjGaDaolXjlCqpngHz3/WVxiGP55mkwvXXZsEUI:v2i0GaDNlX4z/u5/oXZsEU
MD5:	3EEC1839634F3E693E493A9493D6E5D5
SHA1:	53F4A60F2CE97A920D19B4675515D90CAB667806
SHA-256:	2F5D380434C4D3D09137655E7179B6E8F514329042EF4739D5351D8A6F821539
SHA-512:	01FE375E49E0116F5DE3C2D1E92CAAC8199C080A0E7F171AE941D1A48B639C8C2FDCA694A3F6D62C17FFFAC645C5FE79D432E0E6B2E81CF1B312A07154637314
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."................p...............................................'#....`..........................................h..\...\h..x...............................H...@Z..............................`Z..8...............0............................text...(........................... .P`.rdata..nk.......l..................@.P@.data................d..............@.P..pdata...............r..............@.0@.reloc..H............\|..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_philox.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.01929448585436
Encrypted:	false
SSDEEP:	1536:MPsa9aBwaa83TKw3yvU/sGK752WSdbpkO16Hz:MUa9aSaZKw3yvsG752WSdbpzc
MD5:	85FCC8C935DE2F7E678827C36E28C501
SHA1:	4984098AFAF05A21780EB8AA7DD208B649BB7735
SHA-256:	58EAC1A640F755EA6B26AD84BFCFA8BC4240996355FEBE525B5B35AF9E58A4DC
SHA-512:	127CA25E8D67B2B377954E1C03648D75AB863F52F3D159843459A65965391E258ACE8FB04E4388A98BF212DA63E5D8902F1F54FC62EEDFAD191D3EDFE1DFC14E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........r.......................................................>....`.........................................`(..`....(..x............`...............p..........................................8...............@............................text...x........................... .P`.rdata..$\.......^..................@.P@.data........@.......,..............@.P..pdata.......`.......6..............@.0@.reloc.......p.......>..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\_sfc64.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	5.8273899466029775
Encrypted:	false
SSDEEP:	768:tzZfmsAdRmD5RY43+Q/grPjfMW2GFEzSpLCiwXBJQmH2SSpnlIRoPafVhpwdpngw:jeTmD5D+SYEzSZVlSSRaTVMdRg95
MD5:	2A8C4A99787661970936751CBA21288C
SHA1:	831488F8468929A4CC1044585CC7C6CA4614E236
SHA-256:	6FDCBBF5CDAA33D6323D78A911D9BF4A237EFDFFCD1F9B9A0432BC4B13C6F908
SHA-512:	FF1F8CA25E2C65765289138430F44FDB4ECE6B8FF50DBAC1BD51D34F6539FB791989BB42DAFCDAC81026C9633893B32756555658CB7AB48F0A194A8511F838CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........\......`........................................@.......e....`.............................................\.......x............ ...............0......................................0...8............................................text............................... .P`.rdata..&F.......H..................@.P@.data...............................@.P..pdata....... ......................@.0@.reloc.......0......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\bit_generator.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	174592
Entropy (8bit):	6.151653697660786
Encrypted:	false
SSDEEP:	3072:kqmLoIssDysvF8wNRJ3hRw3mPJffodjt2+Warahmb2+WarahjnrSr5UaxjcRNPQ:kqmLoIssDyg8w9w2PNgdJ2+Warahmb2l
MD5:	56359B8D03784A742A5E0544BCF96DFC
SHA1:	31025EEBA4F3DFC21BBC0B08092C9BE5453F7CDE
SHA-256:	DD243EB9ED3EEA8C416BB110C14A29C82510FCD4469BADBCA3AA1001BC4A1E9F
SHA-512:	F3E45311E5A5C83E9CD7240CCA1F3CDBA755F4680B97C716BE0B40975AA5B2F4EA029E294A5032AC4D30E53E8D72FE1235DCEB111FB6D7E3AEA60BBDDB106884
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."................ ...............................................4.....`.........................................@z..l....z..x...............0...................Ph..............................ph..8...............`............................text............................... .P`.rdata..............................@.P@.data....'..........................@.P..pdata..0...........................@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\numpy\random\mtrand.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	643072
Entropy (8bit):	6.22582905783859
Encrypted:	false
SSDEEP:	12288:Ryt+9aaHW8FGcqNK0e++R2X0sL8z3GdvfmUpKqlxMXyQSl0KICagpE804TbhQgk8:wt+9aaHSKKv/Dz70gjHl
MD5:	81CE8F17DFA9157E5B215DC42256DDA3
SHA1:	BD9EDD0401F38C53CC73DA058F2AFA78F28D58FF
SHA-256:	9ACEE80BECD220ADC741E51B48D6D0D5ABE59C5D7ABFA61610BDC91DF74E388C
SHA-512:	2F063EACD23497B56E23EA05424D46AC76B6BE1CA9FBA5A583B5F5B97ED233D2B13391189A447EE23C3EC69DED761BE83C414466C4878573C27A390EF8DD637A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....z...R......0}....................................... ......`.....`....................................................................................x....k...............................k..8............................................text...8x.......z.................. .P`.rdata...............~..............@.P@.data....?..........................@.P..pdata..............................@.0@.reloc..x...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.905419806967227
Encrypted:	false
SSDEEP:	1536:BWseNxkc7Xva0Y420G1UD+dS4QBeLmRy:BWkcbi0Y42bUD+dS44eiRy
MD5:	3CBA71B6BC59C26518DC865241ADD80A
SHA1:	7E9C609790B1DE110328BBBCBB4CD09B7150E5BD
SHA-256:	E10B73D6E13A5AE2624630F3D8535C5091EF403DB6A00A2798F30874938EE996
SHA-512:	3EF7E20E382D51D93C707BE930E12781636433650D0A2C27E109EBEBEBA1F30EA3E7B09AF985F87F67F6B9D2AC6A7A717435F94B9D1585A9EB093A83771B43F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`T..$5..$5..$5..-M3..5..v@..&5..v@..(5..v@..,5..v@.. 5...k..&5..oM..55..$5...5...@..45...@..%5...@_.%5...@..%5..Rich$5..........................PE..d.....e.........." .........h..............................................@............`.........................................P...`.......@.... .......................0..(.......................................8............................................text............................... ..`.rdata..\|I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\python3.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.1037683983631625
Encrypted:	false
SSDEEP:	768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5:	07BD9F1E651AD2409FD0B7D706BE6071
SHA1:	DFEB2221527474A681D6D8B16A5C378847C59D33
SHA-256:	5D78CD1365EA9AE4E95872576CFA4055342F1E80B06F3051CF91D564B6CD09F5
SHA-512:	DEF31D2DF95CB7999CE1F55479B2FF7A3CB70E9FC4778FC50803F688448305454FBBF82B5A75032F182DFF663A6D91D303EF72E3D2CA9F2A1B032956EC1A0E2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..A.e.A.e.A.e.%}m.@.e.%}e.@.e.%}..@.e.%}g.@.e.RichA.e.........................PE..d....K.b.........." ... ..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\python310.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\pywin32_system32\pywintypes310.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.992653928086484
Encrypted:	false
SSDEEP:	3072:DLVxziezwPZSMaAXpuuwNNDY/r06trfSsSYOejKVJBtGdI8hvnMu:HfziezwMMaAX2Y/rxjbOejKDBtG681n
MD5:	CEB06A956B276CEA73098D145FA64712
SHA1:	6F0BA21F0325ACC7CF6BF9F099D9A86470A786BF
SHA-256:	C8EC6429D243AEF1F78969863BE23D59273FA6303760A173AB36AB71D5676005
SHA-512:	05BAB4A293E4C7EFA85FA2491C32F299AFD46FDB079DCB7EE2CC4C31024E01286DAAF4AEAD5082FC1FD0D4169B2D1BE589D1670FCF875B06C6F15F634E0C6F34
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........................................................P............`......................................... u..dB......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\select.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI73362\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI73362\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	987808
Entropy (8bit):	6.655663536343385
Encrypted:	false
SSDEEP:	24576:tVlncbBScMaURxDDMz2UyJaoOn8ynGo5ImxvSZX0ypnikq:blcURaUsz2U7LGjid
MD5:	46E3C39BB0758058AF02FB0DBC115CDB
SHA1:	EB89D853AFC80F1D4786F8DDAF1E08D788077E07
SHA-256:	1142120D03F3BA4E241E41A8AE8E61089E2E46FFE88A223FC39F9E638E5DDE46
SHA-512:	4B4CB596BA18ED3DBB77B44B3369FACAB7A5096C1CD17580172ACFD111B73807D04B42E83EAAE1D2828D2BE7CA7BC9CBE67C4F72309E66A513FBF5B2C57CAC18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&.a.&.a.&.a./.....a.&.`..a..6..'.a.l..'.a.l....a.l..p.a.l....a.l..j.a.l..'.a.l..'.a.Rich&.a.........................PE..d...Q8.U.........." .........N......`........................................ ............`A.........................................+.......................P..p........P.............8...........................P...................H............................text............................... ..`.rdata...u.......v..................@..@.data...."... ......................@....pdata..p....P......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\win32\win32pdh.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.6095534346775215
Encrypted:	false
SSDEEP:	384:mTtWWcU+d47NgCuVuA7dBm7BZ1CHrWBGwm3ReuuR+F1igomyhPGZGdhBcTbC5pEW:mM47+YedBm0WBgIuuGigihAiyTU2Ya
MD5:	C8ACFDC52551398D11F118B349EA1713
SHA1:	05F5411D3E6BA7B44909A057D55A0375D3D5525B
SHA-256:	1E016D886D666322D9CEAF56FDCA4D8B82D1DE37E888019695591681402AAFFF
SHA-512:	18FD699B1A64932BABB5AB39AEB19FEC2FAF0EA536F780DADFCE7A1A4C30BB6DCE1D36CCDB62190E7C8C58CBA612A3F96977BAF5182AD86A38716C8068EC9C43
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|]4d8<Z78<Z78<Z71D.7><Z7jI[6<<Z7,W[6:<Z7jI_64<Z7jI^60<Z7jIY6;<Z7.I[6:<Z7.U[6;<Z78<[7`<Z7.IS69<Z7.IZ69<Z7.IX69<Z7Rich8<Z7........PE..d......d.........." .....D...@.......@....................................................`.........................................@...P...............\............................p..T............................p..8............`...............................text....C.......D.................. ..`.rdata..X,...`.......H..............@..@.data...x............v..............@....pdata...............z..............@..@.rsrc...\...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73362\yaml\_yaml.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	235008
Entropy (8bit):	6.106199166529496
Encrypted:	false
SSDEEP:	3072:g2JsYC1WGdRV20qOUWNRsJQJMrsO/Pq9v0hmbUlgkY4OmqH9z:Gbb20qPgR0QJMEv0h+JH
MD5:	5FA5EA9E7E5740362FB1234349871449
SHA1:	90D6BA63C0194E6CB109C9E51F4DA64E3271E816
SHA-256:	B758AEC10C6E27C30BC5D332A0D7B879788783132461C770F528148757CBC182
SHA-512:	378FA7154A05F394ABBE2F739D538BB41149563F153D41B17D1B8DDB5A18350D444AF9FB21316168D3B1884A7AB17DF0131550D244F4839E3C113B0E8C75C036
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M&..,H..,H..,H..T...,H.YI..,H.TI..,H.C...,H.YM..,H.YL..,H.YK..,H.>YI..,H..,I.T,H.=YL..,H.>Y@..,H.>YH..,H.>Y...,H.>YJ..,H.Rich.,H.........PE..d...).d.........." ......................................................................`..........................................W..\...LX.......................................?..............................@?..8............................................text...8........................... ..`.rdata..lZ.......\..................@..@.data....;...p...(...T..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\Desktop\background_audio.mp3

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 44.1 kHz, Stereo
Category:	dropped
Size (bytes):	15279697
Entropy (8bit):	3.7657855190597838
Encrypted:	false
SSDEEP:	24576:8cyjXQvIfYRnEqgzkyrXopL4F9p/5OcCk8JgrMC2CR+ZoB4jOREP6:tC2mzkyMpWCkH4u+isO
MD5:	7BD275EC828976AC880AD2941525ED84
SHA1:	C521EC64B25748AA9873BE043F891CA87EBD8F3B
SHA-256:	0165D425DE6DD3D336754EA6DDD41FAFF2D3DCC07127CDE0639CF2914218B2A9
SHA-512:	BE30D707076F5DE75DD8442B96C2596151F6DC7A95F6B973C9A12BC5B2D7C21776C4DF4BF513B37CCD34C8E864A2C1E8FC0DB5819320E116BFD6DA2E9C74C5D6
Malicious:	false
Preview:	ID3.......TXXX.......major_brand.mp42.TXXX.......minor_version.0.TXXX.......compatible_brands.isommp42.TSSE.......Lavf58.76.100.............P.................................Xing..........%..............!$',/247:<?BDFILNPSVX[]`bdhjlortvy\|}......................................................Lavc58.13............$.@......%.......................d.....i....... .......... ..4....LAME3.100UUUUUUUUUUUUUUUUUUUUUUUULAME3.100UUUUUUUUUUUUUUUUUUUUUUUUUU...d"....i....... .......... ..4....UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUULAME3.100UUUUUUUUUUUUUUUUUUUUUUUUUU...dD....i....... .......... ..4....UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.6...r..8.!....A0 ...F....@...j2(....df....i....... .......... ..4......wh....N....V\|f....nT?.S.o.S4...6..k....o.}3..;......<...5..W..!....d.....i....... .......... ..4......>@.x.,.`..t.EKTbI.#..?[..a.O.@.......cm.............nl.....Fr...d.....i....... .......... ..4.....b....w.@N.....q..V....N.....PB0.......x.+.x.....z ....^.&.......T...d.....i....... .......... .

C:\Users\user\Desktop\overlay_image.jpg

Download File

Process:	C:\Users\user\Desktop\test.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1080x586, components 3
Category:	dropped
Size (bytes):	22760
Entropy (8bit):	7.840747209174494
Encrypted:	false
SSDEEP:	384:9wPGsVK3vcZJwNgheYIhYuMCk6hopr4SgmCFwJzKCRzcLeS9hO:CPgvoOkaYuMCN+6Bne3
MD5:	5ACF13857303AC1BFA719DE3F5FA8273
SHA1:	8D0AC14501E112C86DC1E5F1DFC0D740A0616B86
SHA-256:	478AFC37201D0746DB7FFE04FFE158D82BD8EC463FCA5F730070EC040A22C87F
SHA-512:	3D774B61D4F82CE3B8519F33A30697EFF4BFFA04D89171A2374F8BE7373E45FF800640F79295950EBD93A1663EB3BB6F0BA997C60E5E706400B89FB224DF570E
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C................2!....=,.$2I@LKG@FEPZsbPUmVEFd.emw{...N`...}.s~.\|...C.......;!!;\|SFS\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|......J.8.."......................................1......................!.1.AQ."a.2q...BR3.#b........................................................!1.A"2............?...C-..e...).8.x"!.h#5...:.-.....F+.o...H.F.......R...$.AD.`......!...@$..Hi.44...!....e..$.Hi.........B...;..4.`.`&.. ....Bh...6Kh..Z...-.h"...He....P C I......@...@HQUcH.HtU..f.TRAH..5...H.Q....!.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.99606083661006
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	test.exe
File size:	62'866'063 bytes
MD5:	120aabd78079a8792013afb29779c425
SHA1:	4db0126a6007588c737ce8c9ecab63922c4f5882
SHA256:	824dd600dd22e7f2b0117eb54d88a5141e234f2d4cfbc5954a6b3dddeedc65e9
SHA512:	347fd81ef9834b7a4201bc184f149f23d8ab6c1963aadf818eb418d69b8ad83de56a54f09f727dc37292e6161e4ac1a1976d7a09021b0b32001dcd9262eaff9b
SSDEEP:	1572864:b6LX5WJoWbgWRSgkNOXWxtQSNyyVQGsOX6yKuQnbis:IX5M3gbcKCynX3KuQb
TLSH:	CAD733455F906885FAADC136CD804E4CBD6A668DC22F87075BF4D2722F573E69CBE202
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67425F9E [Sat Nov 23 23:05:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F1B24EDF20Ch
dec eax
add esp, 28h
jmp 00007F1B24EDEE2Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F1B24EDF5D8h
test eax, eax
je 00007F1B24EDEFD3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F1B24EDEFB7h
dec eax
cmp ecx, eax
je 00007F1B24EDEFC6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007F1B24EDEFA0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F1B24EDEFA9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F1B24EDEFB9h
mov byte ptr [000356F5h], 00000001h
call 00007F1B24EDE705h
call 00007F1B24EDF9F0h
test al, al
jne 00007F1B24EDEFB6h
xor al, al
jmp 00007F1B24EDEFC6h
call 00007F1B24EEC50Fh
test al, al
jne 00007F1B24EDEFBBh
xor ecx, ecx
call 00007F1B24EDFA00h
jmp 00007F1B24EDEF9Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007F1B24EDF019h
cmp ecx, 01h
jnbe 00007F1B24EDF01Ch
call 00007F1B24EDF54Eh
test eax, eax
je 00007F1B24EDEFDAh
test ebx, ebx
jne 00007F1B24EDEFD6h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007F1B24EEC302h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	c8f060a35417bdb2890d58bd2ef6ab89	False	0.5242838541666667	data	5.750767841322882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 08:53:09.529573917 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:09.534424067 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:09.534497023 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:09.534595966 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:09.539350033 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185396910 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185528994 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185580015 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.185590029 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185601950 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185638905 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185640097 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.185651064 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185688019 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.185715914 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185734034 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185745955 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185756922 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.185775042 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.185784101 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.190331936 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.190351963 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.190397024 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.278179884 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278191090 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278203964 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278213978 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278232098 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278243065 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278261900 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.278296947 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.278316021 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278326035 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.278363943 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.278999090 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.279093981 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.279148102 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.279220104 CET	49731	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.284015894 CET	8888	49731	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.298707962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.303445101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.303548098 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.303618908 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.308527946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.932771921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933027983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933041096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933052063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933062077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933074951 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.933079004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933089972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933099031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.933099031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933109045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933116913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.933135033 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.933150053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.933187008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.937879086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.937896967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.937908888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.937936068 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:10.937942982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:10.937989950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.025867939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.025888920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.025898933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.025947094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.025968075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.025979996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026025057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.026237965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026247978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026289940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.026359081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026400089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026408911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.026410103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026448011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026449919 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.026458979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.026499987 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.027163029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.027241945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.027285099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.027288914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.027299881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.027318954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.027338028 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.028000116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.028017998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.028028011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.028047085 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.028059006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.028120041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.028136015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.028172970 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.028871059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.028882027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.028918982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.111963034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.111982107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.112031937 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.119292974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119304895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119321108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119343042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.119405985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119416952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119426966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119437933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119460106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119657040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.119775057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119791985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119802952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119849920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119851112 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.119894981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.119905949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119915962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119956017 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.119977951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.119988918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120028019 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.120799065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120809078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120819092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120851040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.120878935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120891094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120899916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120909929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.120924950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.120949984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.120969057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121015072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.121758938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121817112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121828079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121860981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.121943951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121956110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121964931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121975899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121987104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.121994972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.122006893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.122025967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.122752905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122787952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122798920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122836113 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.122874022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122883081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122899055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122909069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122911930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.122936964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.122951984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.122992992 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.123697042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.156841040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.156852961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.156862974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.156922102 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.156955957 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.198491096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.198501110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.198517084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.198527098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.198549032 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.198576927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.204962015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.204974890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.205039978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211416960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211435080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211447001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211474895 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211538076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211549044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211559057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211579084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211596966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211601019 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211607933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211646080 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211757898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211767912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211781979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211807013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211899042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211909056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211919069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211944103 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211946964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211960077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.211966991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.211991072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.212158918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212215900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212225914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212255001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.212377071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212394953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212404013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212420940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.212439060 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.212512016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212522030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212532997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212543011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212557077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.212583065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.212912083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212922096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212934971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212969065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.212976933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213010073 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213037014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213047981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213058949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213068962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213080883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213108063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213468075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213478088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213489056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213511944 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213589907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213599920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213614941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213635921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213650942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213660955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213660955 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213671923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213681936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213687897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.213691950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.213716030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.214210987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214252949 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.214260101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214271069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214306116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.214319944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214329958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214339972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214350939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214376926 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.214379072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214394093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214397907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.214428902 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.214469910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214479923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.214514971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.240375042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.240385056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.240396023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.240437031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.240518093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.240529060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.240561008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.283184052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.284497976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284512043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284523010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284532070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284543037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284553051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284559965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.284564972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284574032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.284596920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.284616947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.291006088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.291081905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.291093111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.291111946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.291127920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.291143894 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297419071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297436953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297485113 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297487974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297540903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297552109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297583103 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297605991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297616005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297626972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297643900 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297668934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297718048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297729015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297739983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297750950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297765017 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297780991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297838926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297851086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297862053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297873974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.297900915 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.297929049 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298088074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298115015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298152924 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298192024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298239946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298252106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298279047 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298413992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298429012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298439980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298450947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298460960 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298469067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298480034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298480988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298492908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298502922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298515081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298520088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298532963 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298556089 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.298686028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298727036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298743010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.298763990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304287910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304299116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304310083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304356098 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304373980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304383039 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304385900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304420948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304604053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304686069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304699898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304721117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304727077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304738045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304749012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304760933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304783106 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304810047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304817915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304831982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304841995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304852009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304858923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304884911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304913998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304953098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.304955959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.304963112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305000067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305037022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305048943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305058956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305088043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305125952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305136919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305167913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305250883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305267096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305275917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305290937 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305311918 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305372953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305417061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305428028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305454016 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305460930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305470943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305497885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305624008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305635929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305645943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305665016 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305675030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305685043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305696011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305706024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305735111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305779934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305790901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305799961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.305818081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.305843115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.306016922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306055069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306066036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306090117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.306154013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306165934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306175947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306186914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306195974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.306216002 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.306267977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306278944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306288958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306299925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306309938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.306310892 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.306327105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.306355953 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309170961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309221029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309231043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309264898 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309272051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309282064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309292078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309307098 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309319019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309325933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309329987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309376001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309416056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309426069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309436083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309451103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309469938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309493065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309499979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309514999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309525013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309534073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.309555054 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.309562922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.311985016 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.328727007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.328748941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.328759909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.328784943 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.328816891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.328828096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.328835964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.328846931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.328855991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.328864098 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.370908022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.370981932 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.371083021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.371093988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.371108055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.371117115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.371126890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.371136904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.371141911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.371150970 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.371191978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.383728981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383740902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383749962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383793116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.383797884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383809090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383817911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383829117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383848906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.383884907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.383903027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383918047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383928061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383953094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.383961916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383970976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.383971930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.383982897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384012938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384053946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384068966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384079933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384089947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384099960 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384128094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384198904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384210110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384219885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384231091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384242058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384251118 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384274006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384274006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384280920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384301901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384340048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384361029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384370089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384380102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384390116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384407997 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384433031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384507895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384520054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384532928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384543896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384553909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384573936 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384588003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384605885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384610891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384620905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.384625912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384664059 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.384674072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390283108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390294075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390304089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390315056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390351057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390352964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.390371084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390398979 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.390427113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390465021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390472889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.390708923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390749931 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.390769958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390779972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390796900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390805006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390815020 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.390846968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.390850067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390861034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390870094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390878916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.390906096 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.390930891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391092062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391125917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391135931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391165972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391177893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391191959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391200066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391228914 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391247034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391329050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391339064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391349077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391357899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391366959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391371012 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391377926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391401052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391446114 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391465902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391477108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391486883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391496897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391505957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391514063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391525030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391532898 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391535997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391562939 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391587973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391654015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391665936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391674995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391685963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391696930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391736984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391757965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391767025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391776085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391789913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391798973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391808987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391819954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391843081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391854048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391911030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391921997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391932011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391942024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391952038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391959906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.391963005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391973019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.391977072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392004967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392051935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392062902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392093897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392117977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392127991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392138004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392148018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392157078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392157078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392187119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392208099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392258883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392371893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392381907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392391920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392402887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392412901 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392412901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392422915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392432928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392433882 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392443895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.392453909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.392467022 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.414745092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414756060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414767027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414776087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414793015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414802074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.414804935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414855957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414858103 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.414866924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.414891005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.455070972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.456851959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.456888914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.456899881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.456945896 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.456967115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.456981897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.457006931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.457024097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.457030058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.457053900 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.469948053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.469989061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.469999075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470010996 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470038891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470045090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470056057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470065117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470089912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470180988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470191956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470201969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470211983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470217943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470227957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470233917 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470268965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470288038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470298052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470336914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470338106 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470350981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470376015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470463037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470474005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470484018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470494032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470504045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470511913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470511913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470535040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470562935 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470583916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470593929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470607996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470618010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470628023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470629930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470668077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470741987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470753908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470763922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470772982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470792055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470810890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470827103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470837116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470845938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470855951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470865965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.470868111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.470896006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.471035004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.471044064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.471081018 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.476630926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476677895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476679087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.476690054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476730108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.476747036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476758003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476768017 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476778030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476794004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.476813078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.476901054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476953030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476962090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.476986885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477003098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477015972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477025032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477046967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477088928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477109909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477118969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477123976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477159977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477168083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477180004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477189064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477207899 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477232933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477233887 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477243900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477257013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477293968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477296114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477307081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477334976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477355957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477366924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477401972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477442026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477456093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477467060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477475882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477485895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477487087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477514982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477521896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477530956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477545977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477556944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477567911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477570057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477603912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477679968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477689981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477700949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477711916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477721930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477721930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477731943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477756977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477766037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477782965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477792978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477802038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477812052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477826118 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477838993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477854013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477863073 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477864981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477874041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477891922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477910042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.477967024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477979898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.477991104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478002071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478018045 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478039980 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478121042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478132963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478142977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478156090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478167057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478189945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478200912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478203058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478209972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478220940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478233099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478255987 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478323936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478334904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478346109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478355885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478370905 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478396893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478445053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478456974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478466988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478477001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.478492975 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478513956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.478571892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501024961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501034021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501044035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501068115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.501095057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.501121044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501132011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501142979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501152992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.501168013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.501187086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.543052912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543062925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543080091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543103933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543111086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.543117046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543153048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.543286085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543298006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543308020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.543333054 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.543345928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556226969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556235075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556246042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556272030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556282997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556298971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556308985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556324959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556353092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556368113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556377888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556387901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556416988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556425095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556435108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556453943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556457043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556463957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556489944 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556544065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556555033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556600094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556698084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556710005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556720018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556729078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556739092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556744099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556756973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556766033 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556767941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556777954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556787968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556790113 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556797028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556807041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556807995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556828976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556863070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.556874990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556893110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556902885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.556929111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.557049036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557060003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557070971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557081938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557105064 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.557125092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.557183027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557197094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557207108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557219028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.557224989 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.557248116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.562612057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562642097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562652111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562685966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562688112 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.562697887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562772036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.562820911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562832117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562840939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.562910080 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.563539982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.563596010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.563606977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.563607931 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.563654900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.563667059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.563677073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.563709974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.563719034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.563757896 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564249039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564260960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564270020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564295053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564302921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564312935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564322948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564332962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564367056 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564367056 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564383984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564393044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564410925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564433098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564438105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564443111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564510107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564519882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564528942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564538002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564555883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564560890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564565897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564579010 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564599037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564619064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564627886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564635992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564646959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564655066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564656973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564681053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564708948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.564779043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564790010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564800978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.564826965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565357924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565391064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565401077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565402031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565448999 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565469027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565485001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565495968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565505981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565521002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565525055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565546036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565594912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565634012 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565699100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565768957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565779924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565809011 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565903902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565918922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565928936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565937996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565953970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565953970 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565963030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565977097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565980911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.565987110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.565989971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566001892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566013098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566023111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566051960 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566056013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566066980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566090107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566096067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566108942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566117048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566133022 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566163063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566174984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566198111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566209078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566237926 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566262960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566273928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566313982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.566322088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.566364050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.587435961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.587454081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.587464094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.587475061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.587486029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.587495089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.587506056 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.587507010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.587538004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.629367113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.629436016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.629446983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.629446983 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.629457951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.629488945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.629515886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.629528046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.629538059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.629569054 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.629606009 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646195889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646248102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646259069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646306038 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646311998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646322966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646332979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646358967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646384001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646421909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646431923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646444082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646455050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646476030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646488905 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646564007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646574020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646584034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646594048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646604061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646614075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646622896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646632910 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646632910 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646632910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646656990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646672010 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646853924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646864891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646876097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646886110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646903038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646903038 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646914005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646923065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646925926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646935940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646946907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646956921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646959066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646967888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646976948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646979094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646986961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.646997929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.646997929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.647012949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.647016048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.647027969 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.647177935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.647228003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.649084091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.649133921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.649188042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.649193048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.649204969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.649231911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.649240971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.649243116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.649256945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.649277925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651459932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651499033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651505947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651510000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651545048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651547909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651556015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651561975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651592016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651595116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651602030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651639938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651721954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651731968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651741982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651755095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651765108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651773930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651776075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651782036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651823044 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651870012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651880980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651890039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651900053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651911020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651916981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651921988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651926994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651932955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.651953936 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.651979923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652025938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652036905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652049065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652059078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652070999 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652074099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652084112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652101994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652126074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652184010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652195930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652204990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652209044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652215004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652225018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652235985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652247906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652287006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652324915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652334929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652344942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652354956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652364969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652370930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652379036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652379990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652391911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652403116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652407885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652437925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652470112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652482033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652513981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652533054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652544975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652556896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652568102 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652570009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652595043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652620077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652631044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652643919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652656078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652688980 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652703047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652714968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652728081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652738094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.652751923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.652777910 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.673909903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.673922062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.673932076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.673975945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.673989058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.674000025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.674009085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.674021006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.674034119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.674047947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.720227003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.720237970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.720247984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.720293045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.720304012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.720314980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.720315933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.720330954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.720355988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.720376015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729089022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729098082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729108095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729139090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729142904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729182005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729202032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729212046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729222059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729232073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729249954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729269028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729270935 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729347944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729357004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729367971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729392052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729415894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729417086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729425907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729463100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729526997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729537010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729547024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729557037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729574919 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729599953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729600906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729609966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729620934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729629993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729640007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729650021 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729669094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729763985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729774952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729784012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729793072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729803085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729804993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729811907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729821920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.729824066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729846001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.729866982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.732029915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.732085943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.732096910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.732125998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.732131958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.732142925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.732173920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.732183933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.732183933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.732218027 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.735203028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735212088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735222101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735238075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735249043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735264063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735270023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.735270023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.735296011 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.735323906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735341072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.735372066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739146948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739157915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739168882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739178896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739212990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739239931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739239931 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739250898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739262104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739272118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739284039 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739305019 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739306927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739321947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739356995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739459038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739469051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739479065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739490986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739501953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739504099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739516020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739526987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739537001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739540100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739547968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739583969 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739594936 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739614010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739624977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739635944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739645958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739656925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739659071 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739666939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739695072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739711046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739713907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739818096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739828110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739836931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739849091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739859104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739869118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739871025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739878893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739890099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739891052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739926100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.739965916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739976883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.739988089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740000010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740010023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740020990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740029097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740029097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740050077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740068913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740070105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740080118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740089893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740098000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740108967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740122080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740128040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740132093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740148067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740181923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740236998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740278959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740289927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740318060 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740339041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740350008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740360975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740370989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.740387917 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.740412951 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.760021925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760046005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760056973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760108948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.760109901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760123014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760133028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760166883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.760230064 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.760250092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760284901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.760292053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.806421041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806431055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806441069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806457996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806468010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806478024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806488991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806505919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.806510925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.806621075 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815485001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815500021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815516949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815530062 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815553904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815565109 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815568924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815582991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815607071 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815635920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815648079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815675974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815695047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815706968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815757036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815793037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815804005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815815926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815828085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815840006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815840006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815871000 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815880060 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815911055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815922976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815932989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.815962076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.815989971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816000938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816010952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816023111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816035986 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.816040993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.816108942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816119909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816131115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816154957 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.816180944 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.816189051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816200018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816210985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816239119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.816251993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.816292048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.818275928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818285942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818295956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818317890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.818339109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818356991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818368912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818387985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.818392038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818403959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.818414927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.818439960 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.821429014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821439981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821451902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821463108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821475983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821480036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.821486950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821508884 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.821540117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.821589947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821599960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.821655035 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825215101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825223923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825238943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825249910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825259924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825265884 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825269938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825288057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825316906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825340986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825351000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825361013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825370073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825378895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825387955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825397015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825421095 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825436115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825447083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825480938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825490952 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825495005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825506926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825515985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825525999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825531006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825570107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825592041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825603008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825613022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825650930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825669050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825679064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825689077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825706959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825707912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825715065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825731039 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825752020 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825802088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825812101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825829029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825841904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825850964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.825858116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.825874090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826041937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826052904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826062918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826072931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826082945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826082945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826093912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826103926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826108932 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826147079 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826169014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826184034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826194048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826195002 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826204062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826214075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826220989 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826221943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826237917 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826267004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826301098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826359987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826370001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826399088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826423883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826433897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826467991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826550007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826561928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826571941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826581955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826590061 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826594114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826603889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826613903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826617956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826656103 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826656103 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826677084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826688051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826697111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826708078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826718092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826729059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.826730013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826750994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.826769114 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.856606007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.856616974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.856628895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.856647015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.856659889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.856672049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.856672049 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.856684923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.856709003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.895271063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.895282030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.895292044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.895327091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.895349979 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.895417929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.895428896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.895440102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.895451069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.895462990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.895494938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910064936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910088062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910099030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910126925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910192966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910203934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910212994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910224915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910242081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910276890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910341024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910351992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910362005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910372019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910382986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910387993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910398006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910399914 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910427094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910448074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910497904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910640955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910656929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910666943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910676956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910680056 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910687923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910697937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910705090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910713911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910725117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910736084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910739899 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910746098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910757065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910761118 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910765886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910775900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910784006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910785913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.910816908 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.910998106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911010027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911019087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911030054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911039114 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.911081076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.911144018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911154985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911168098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911179066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911181927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.911189079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911200047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911210060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.911216021 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.911254883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.913321018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913368940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913379908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913415909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.913438082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913449049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913459063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913469076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913472891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.913491964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.913656950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913695097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.913732052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913743019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913753033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913764954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913779974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.913803101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.913815022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913827896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913846016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.913867950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914299011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914318085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914326906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914339066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914360046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914372921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914428949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914443970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914469004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914506912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914518118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914526939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914537907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914551973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914580107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914608002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914611101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914628029 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914681911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914694071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914705038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914722919 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914736032 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914800882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914812088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914822102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914832115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914841890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914846897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914865017 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914870024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914920092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914928913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914938927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914962053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914968967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.914972067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.914994001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915004969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915014982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915041924 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915101051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915112019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915121078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915132046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915142059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915143967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915165901 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915205956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915215969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915226936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915236950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915242910 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915251970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915266991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915290117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915326118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915342093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915350914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915374994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.915396929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915406942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.915425062 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.952167988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.952178001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.952192068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.952212095 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.952228069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.952320099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.952328920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.952338934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.952348948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.952380896 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.952392101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.981528044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.981554985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.981568098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.981611967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.981618881 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.981662989 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.981676102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.981687069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.981695890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.981731892 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.996881962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.996892929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.996901989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.996912956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.996922970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.996931076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.996933937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.996954918 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.996968031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.996983051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.996998072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997009039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997019053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997030973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997031927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997040033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997059107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997081041 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997109890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997119904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997153997 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997284889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997296095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997306108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997314930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997325897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997329950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997335911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997344971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997349977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997354031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997365952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997375965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997378111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997391939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997402906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997437954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997565031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997575045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997584105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997595072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997605085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997610092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997613907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997623920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997634888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997642040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997653961 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997673035 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997708082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997718096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997723103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997728109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997765064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997775078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997778893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997785091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997795105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:11.997818947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:11.997844934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.002444983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002463102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002473116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002511024 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.002547979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002558947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002588987 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.002609015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002619028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002629042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.002651930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.002667904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.003578901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.003590107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.003601074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.003631115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.003638029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.003655910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.003667116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.003678083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.003679037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.003709078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005031109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005042076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005084038 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005129099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005143881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005153894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005162954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005167007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005173922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005186081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005206108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005227089 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005736113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005785942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005789995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005795956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005834103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005836964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005844116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005853891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005898952 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005928040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005939007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005948067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005958080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005965948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.005976915 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.005999088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006062984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006072998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006082058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006094933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006104946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006108999 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006114006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006124020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006140947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006140947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006151915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006166935 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006187916 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006217003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006227016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006236076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006246090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006263018 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006274939 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006330013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006340027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006349087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006359100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006371021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006391048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006408930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006470919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006481886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006491899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006504059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006514072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006515026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006525040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006534100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.006551027 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.006577015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.038343906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038355112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038361073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038393974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038405895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038429976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.038460970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038470984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038470984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.038480043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.038515091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.068032026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.068048000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.068058014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.068063021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.068072081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.068083048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.068093061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.068104982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.068136930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083154917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083163977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083173990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083185911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083195925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083205938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083221912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083250999 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083287954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083317041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083327055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083399057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083404064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083415985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083425999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083436966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083446980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083466053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083477974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083486080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083509922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083657026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083667040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083676100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083686113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083695889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083702087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083707094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083715916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083724022 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083726883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083736897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083745956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083748102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083764076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083790064 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083801985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083846092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083940029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083950996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083960056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083971024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083981037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.083986998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.083991051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084002972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084012032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084016085 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.084022045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084032059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084038019 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.084043026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084057093 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.084074974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.084207058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084217072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084232092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084239960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.084249020 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.084275007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.088898897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.088908911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.088917971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.088942051 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.088960886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.088970900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.088970900 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.088980913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.089010000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.089010954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.089051008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.090255976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.090266943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.090276957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.090305090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.090328932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.090338945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.090352058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.090363026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.090377092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.090396881 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.091337919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091347933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091357946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091367960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091384888 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.091401100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.091423988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091434002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091443062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091469049 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.091485023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.091645956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091655970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091665983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091696978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.091716051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091727018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091737032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091761112 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.091773987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.091784954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092030048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092040062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092050076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092077971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092097044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092101097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092108011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092117071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092129946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092143059 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092166901 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092238903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092247963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092257977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092268944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092279911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092287064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092307091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092314959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092322111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092327118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092336893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092344046 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092367887 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092401028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092411995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092421055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092431068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092441082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092447996 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092467070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092487097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092534065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092545986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092555046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092565060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092575073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092581987 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092586040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092596054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.092607021 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.092627048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.124636889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.124648094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.124658108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.124718904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.124721050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.124730110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.124735117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.124753952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.124783039 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.124799013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.154134989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154167891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154176950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154222965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154233932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154238939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154266119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154306889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.154313087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.154373884 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169310093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169320107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169329882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169378996 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169390917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169416904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169426918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169437885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169464111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169469118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169521093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169531107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169578075 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169612885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169622898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169641018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169651031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169661045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169663906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169687986 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169701099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169766903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169779062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169787884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169797897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169807911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169812918 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169837952 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169893980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169903040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169912100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169945002 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169966936 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.169971943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169981956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.169996023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170005083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170020103 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170043945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170053959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170090914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170099974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170125008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170192957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170207977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170218945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170228958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170229912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170250893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170322895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170334101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170342922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170353889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170363903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170367956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170372963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170397043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170423031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170444012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170455933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170465946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.170489073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.170506001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.175052881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175065041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175074100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175111055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.175127029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175137043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175147057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175157070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175180912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.175283909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.175283909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.175283909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.176367998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176388979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176412106 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.176414967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176424980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176462889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.176480055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176491022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176501989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176511049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.176525116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.176544905 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177597046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177611113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177622080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177644014 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177664995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177674055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177680016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177690983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177700043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177719116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177738905 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177792072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177800894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177835941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177905083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177916050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177926064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177937984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177952051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177961111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.177964926 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177988052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.177999973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178118944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178136110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178170919 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178257942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178267956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178277016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178301096 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178334951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178344965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178354025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178379059 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178386927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178396940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178402901 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178407907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178426981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178481102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178491116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178500891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178509951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178519964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178529024 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178564072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178625107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178634882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178643942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178654909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178664923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178667068 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178674936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178702116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178719997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178726912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178747892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178757906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178785086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178806067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178817034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178827047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178855896 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.178862095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.178878069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.210867882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.210902929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.210913897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.210982084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.210993052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.211003065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.211023092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.211035013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.211064100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.211086988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.241220951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241230965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241240025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241250992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241261959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241271973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241358042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.241362095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241372108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.241426945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257380962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257394075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257406950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257422924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257430077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257436037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257447004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257460117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257460117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257476091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257498026 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257523060 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257540941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257560015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257571936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257582903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257594109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257606030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257607937 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257622004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257631063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257633924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257646084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257658005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257658958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257671118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257679939 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257693052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257704020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257715940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257716894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257725000 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257729053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257741928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257752895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257757902 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257759094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257771969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257783890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257793903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257803917 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257807970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257819891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257819891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257821083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257838011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257858038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257858992 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257869959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257883072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257894039 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257894993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257906914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257917881 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257917881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257930994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257941961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257953882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257957935 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257968903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257975101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.257983923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257996082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.257997036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.258023977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.258029938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.262095928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.262109041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.262120008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.262151957 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.262238026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.262248993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.262260914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.262273073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.262279987 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.262295008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.263346910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263394117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.263555050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263566017 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263576031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263587952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263602018 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.263603926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263613939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263622999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.263631105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.263652086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.264611959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.264621973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.264632940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.264642000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.264653921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.264657021 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.264681101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.264694929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.264771938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.264784098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.264825106 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265078068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265089035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265100002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265130043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265228987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265239000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265249014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265258074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265280962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265305042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265481949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265492916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265532017 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265625000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265638113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265646935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265656948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265667915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265671968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265681982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265716076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265763044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265770912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265782118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265793085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265801907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265810013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265813112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265822887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265832901 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265860081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265942097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265953064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265966892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265975952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265983105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.265985966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.265995979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266014099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.266035080 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.266091108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266100883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266113997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266124010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266134977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266140938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.266145945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266154051 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.266172886 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.266278028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266288042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266298056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266309023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.266323090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.266350031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.322491884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.322510958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.322520971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.322568893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.322597027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.322607994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.322618961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.322635889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.322650909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.322663069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.326824903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.326836109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.326845884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.326875925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.326900959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.326977015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.326987028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.326998949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.327008963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.327027082 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.327053070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.341995001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342014074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342024088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342062950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342099905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342111111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342120886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342142105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342164993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342263937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342274904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342286110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342292070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342302084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342312098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342339993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342361927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342415094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342426062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342436075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342462063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342515945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342526913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342538118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342547894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342557907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342562914 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342572927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342582941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342592001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342611074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342627048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342818975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342833996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342839956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342849970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342859983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342873096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342883110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342885971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342894077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342911005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342914104 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342921019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.342937946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.342973948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.343072891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343084097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343094110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343105078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343115091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343127966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343130112 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.343139887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343148947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343158007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.343158960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.343177080 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.343197107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.347814083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.347825050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.347836018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.347878933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.347891092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.347897053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.347902060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.347912073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.347922087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.347937107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.347963095 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.349010944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.349020958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.349031925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.349062920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.349070072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.349080086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.349090099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.349101067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.349145889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350030899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350042105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350053072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350086927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350100994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350109100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350114107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350125074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350133896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350159883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350198030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350464106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350474119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350483894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350511074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350528002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350538969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350548983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350559950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350573063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350586891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350760937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350769997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350780964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350805998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350810051 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350833893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350835085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350846052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350883961 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.350951910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350963116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350972891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350982904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.350992918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351016998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351041079 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351043940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351054907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351064920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351099968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351128101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351138115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351147890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351159096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351169109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351176977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351203918 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351263046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351273060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351281881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351293087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351300955 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351305008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351321936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351352930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351352930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.351392031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351402044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351413012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.351437092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.392720938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.408727884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.408895016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.408905029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.408916950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.408926964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.408936977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.408947945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.408947945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.408998966 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.413012981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.413022995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.413033009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.413064957 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.413080931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.413091898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.413091898 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.413101912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.413116932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.413122892 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.413161993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428328991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428339958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428349972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428389072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428400040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428411007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428421974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428431988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428443909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428462029 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428476095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428487062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428535938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428668976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428679943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428689957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428704023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428714991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428716898 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428726912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428735971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428736925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428757906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428788900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428798914 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428800106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428812027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428822041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428833008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428842068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428843975 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428880930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.428934097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428951025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428961992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.428997040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429060936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429076910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429086924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429095984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429106951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429107904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429128885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429155111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429183006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429193020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429203987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429218054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429228067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429239988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429260969 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429404974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429426908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429435968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429446936 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429466009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429476023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429547071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429558039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429572105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.429604053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.429625988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.434104919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.434114933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.434124947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.434163094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.434189081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.434199095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.434209108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.434218884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.434233904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.434258938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.435357094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.435400963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.435411930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.435661077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.435704947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.435731888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.435759068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.435770988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.435780048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.435801983 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.435826063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436122894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436131001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436141014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436151981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436162949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436182976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436182976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436182976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436193943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436224937 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436235905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436244965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436275005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436667919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436677933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436683893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436708927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436721087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436722994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436758041 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436769962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436780930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436789989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436819077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436942101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436988115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.436988115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.436996937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437006950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437016010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437042952 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437048912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437084913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437088966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437099934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437108994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437136889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437155962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437227011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437269926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437279940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437289000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437314034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437335968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437338114 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437345982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437355995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437366009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437387943 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437412024 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437424898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437438965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437455893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437468052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437478065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437480927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437486887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437496901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437565088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437589884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437599897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437607050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437611103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437624931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437635899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437635899 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437653065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437673092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437683105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.437707901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437716007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.437751055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.486303091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.494978905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.494990110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.494999886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.495039940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.495112896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.495124102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.495134115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.495143890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.495151997 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.495172977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.499330044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499341011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499351978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499367952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499380112 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.499381065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499392033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499403000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499412060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.499418974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.499448061 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514600992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514611006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514621019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514643908 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514667988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514794111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514805079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514815092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514826059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514837027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514839888 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514847040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514857054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514868021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514878988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514890909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514894009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514904976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514911890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514945030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514950037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.514955997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514966011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.514986992 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515045881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515058041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515070915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515084028 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515106916 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515120983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515130997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515141964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515177011 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515228987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515239000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515248060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515259027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515270948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515280008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515425920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515435934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515444994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515455961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515470028 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515490055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515494108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515501022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515511036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515521049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515531063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515542030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515542030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515552044 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515578032 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515665054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515675068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515685081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515696049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515706062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515708923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515717030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.515721083 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.515748978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.520343065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520354033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520364046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520375013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520390034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.520391941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520401955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520420074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.520436049 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.520443916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520462990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.520479918 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.521604061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521612883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521622896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521662951 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.521665096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521675110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521684885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521692038 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.521694899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521723986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521724939 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.521733046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.521745920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.521778107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.522438049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522448063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522458076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522485971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.522501945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522512913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522521973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522542953 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.522552967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.522566080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522794008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522833109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522839069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.522841930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522859097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522869110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522881031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.522892952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522907972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.522958994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522969007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522978067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.522995949 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523017883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523148060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523164988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523173094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523204088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523211002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523221016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523252964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523356915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523366928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523377895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523386955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523389101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523403883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523415089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523430109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523433924 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523457050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523457050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523468018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523493052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523508072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523509979 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523523092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523538113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523547888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523559093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523566008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523586035 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523639917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523650885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523660898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523670912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523680925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523684025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523691893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523705959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523726940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523753881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523787975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523793936 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523797989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523843050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523873091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523881912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523931980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523932934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.523942947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.523984909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.583672047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.583683014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.583693027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.583726883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.583905935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.583916903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.583928108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.583937883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.583950043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.583978891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.585840940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.585851908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.585861921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.585887909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.585902929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.585936069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.585947037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.585957050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.585968018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.585982084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.586009026 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601007938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601186037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601197004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601207018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601217985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601227999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601227999 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601244926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601246119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601254940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601264000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601269007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601274014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601284981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601291895 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601295948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601311922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601336002 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601465940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601476908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601486921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601497889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601514101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601522923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601525068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601545095 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601567030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601620913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601636887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601648092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601658106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601667881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601677895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601684093 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601706028 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601716995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601772070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601787090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601799011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601809025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601826906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601840973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601917028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601927042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601943970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601953983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601963997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601974010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601977110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601984024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.601993084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.601994038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.602004051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.602014065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.602016926 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.602025032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.602035046 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.602051973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.602174044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.602184057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.602221012 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.606750011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.606760025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.606770992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.606792927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.606803894 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.606868982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.606879950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.606890917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.606899977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.606918097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.606941938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.607836008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.607846975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.607856989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.607878923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.607897997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.607908010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.607918024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.607928991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.607944965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.607971907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.608654976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.608665943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.608676910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.608699083 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.608711004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.608716011 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.608724117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.608757019 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.608809948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.608820915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.608870029 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.609205008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609215975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609225988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609252930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.609271049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609281063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609291077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609301090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609318018 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.609345913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.609488010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609523058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609532118 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.609533072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609564066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.609592915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609602928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609612942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609627008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.609637976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.609673977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610043049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610080004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610090971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610126972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610143900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610155106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610163927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610174894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610191107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610219002 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610253096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610264063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610275030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610301018 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610320091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610399961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610410929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610419989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610430956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610441923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610446930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610451937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610462904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610472918 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610474110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610483885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610491991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610510111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.610554934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.610599995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.669943094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.670329094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.670337915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.670348883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.670357943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.670372009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.670377970 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.670383930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.670409918 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.672077894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.672087908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.672099113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.672132969 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.672142982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.672146082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.672157049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.672188044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.672194958 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.672200918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.672233105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687253952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687469006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687479973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687491894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687503099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687519073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687525034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687530041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687541008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687545061 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687551022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687561989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687566996 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687575102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687578917 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687592030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687592983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687623978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687623978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687634945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687645912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687657118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687670946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687696934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687715054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687736988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687751055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687774897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687844992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687855959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687865019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687874079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.687891960 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687916040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.687999010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688011885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688029051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688039064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688046932 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688050032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688059092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688066006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688076019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688082933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688123941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688158035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688168049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688179970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688190937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688205004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688230038 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688298941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688309908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688319921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688329935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688344002 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688363075 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.688385010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688395023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688405037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.688426971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.692920923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.692976952 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.693037987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693047047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693064928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693075895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693085909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.693088055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693099022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693109989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693114042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.693119049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.693142891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.693164110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694077015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694165945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694175959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694185972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694207907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694221020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694227934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694231987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694247961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694271088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694822073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694833040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694843054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694853067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694868088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694869041 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694900990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694919109 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694925070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694936037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.694972992 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.694988012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695507050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695517063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695527077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695547104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695553064 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.695558071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695569038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695579052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695586920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.695590019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695612907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.695617914 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.695619106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695628881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695679903 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.695693016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695702076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695712090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695729971 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695736885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.695740938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695750952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.695759058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.695782900 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696275949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696285963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696295977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696340084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696348906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696351051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696361065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696371078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696394920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696402073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696419954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696434975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696444988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696455002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696535110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696544886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696548939 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696554899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696568012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696583033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696584940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696593046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696605921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696626902 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696657896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696666956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696676970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696693897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696708918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.696711063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.696743965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.751933098 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.757415056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.757426023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.757436037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.757483959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.757493973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.757494926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.757504940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.757515907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.757540941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.757561922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.758609056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.758619070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.758627892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.758656979 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.758686066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.758698940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.758709908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.758718967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.758728981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.758753061 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.758780003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774485111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774496078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774507046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774543047 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774579048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774590015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774600983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774610996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774626017 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774667978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774676085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774687052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774698019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774724007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774735928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774863005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774873018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774883032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774893045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774903059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774909973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774913073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774923086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774934053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.774935961 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774954081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.774975061 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775018930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775029898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775039911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775049925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775068998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775083065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775157928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775170088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775178909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775188923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775197983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775207996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775213003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775218010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775228977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775238037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775243044 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775248051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775259018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775268078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775290012 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775536060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775547028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775557041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775567055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775577068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775588036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775588036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775598049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.775613070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.775657892 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789611101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789710045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789720058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789731026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789741039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789752007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789752960 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789762020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789782047 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789793015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789860010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789870024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789885044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789895058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789904118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789906979 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789913893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789923906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789927959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789933920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789944887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.789946079 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789963961 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.789992094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790069103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790079117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790121078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790220022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790230036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790239096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790250063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790258884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790266037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790276051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790287971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790288925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790298939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790309906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790318966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790323019 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790329933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790338993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790349960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790354967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790359974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790359974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790370941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790380001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790406942 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790564060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790611029 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790718079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790729046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790739059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790749073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790760994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790764093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790776014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790785074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790787935 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790796041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790805101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790807009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790817976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790832996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790838957 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790843010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790853977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790863037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790863991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790874958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790878057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790884972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790894985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.790911913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.790935993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.791201115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.791215897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.791225910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.791246891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.791275978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.843677044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843688011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843698025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843725920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.843810081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843822002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843832016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843841076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843849897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.843854904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.843866110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.843894958 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.844734907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844750881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844759941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844786882 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.844801903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844811916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844846964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.844856024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844866991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844881058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844888926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.844898939 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.844924927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860438108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860449076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860466003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860477924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860491037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860507011 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860518932 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860521078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860529900 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860532045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860543966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860562086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860574007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860586882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860616922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860619068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860630035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860655069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860667944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860680103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860706091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860729933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860742092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860773087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860795975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860806942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860819101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860831022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860840082 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860858917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860866070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860898972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.860924006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860935926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860948086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.860969067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.861100912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861113071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861124039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861135960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861155033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861166954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861179113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861185074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861191034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861232042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861277103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861289024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861351967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.861376047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861387968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861399889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861411095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861414909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.861443043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.861565113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861577034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861588001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861599922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861608982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.861613035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861623049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.861627102 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.861649990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.875730991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875741959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875751019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875781059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875790119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.875792027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875818014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875825882 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.875828028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875861883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875874043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.875899076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875931025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875942945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.875972986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.875983000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876013041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876014948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876025915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876051903 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876128912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876138926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876148939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876164913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876169920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876176119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876188040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876224041 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876255035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876265049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876276016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876316071 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876344919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876355886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876365900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876374960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876383066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876385927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876426935 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876444101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876446962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876457930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876504898 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876535892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876548052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876557112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876568079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876585007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876604080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876606941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876631021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876641035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876672029 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876734018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876744986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876755953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876765966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876774073 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876795053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.876969099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876979113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.876988888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877000093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877012014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877016068 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.877022982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877033949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877041101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.877044916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877058983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877060890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.877090931 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.877104044 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.877104998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877115965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877151966 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.877188921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877199888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877209902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877219915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877230883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.877238989 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.877254009 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.923824072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.936882019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936892986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936908960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936918974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936928988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936939001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936949015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.936949968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936961889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936981916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.936994076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.937006950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.937006950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.937016964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.937040091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.937098026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.937108994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.937123060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.937140942 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.937160015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.946744919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946757078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946773052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946795940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.946811914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946822882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946849108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.946851015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946861982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946890116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.946948051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946959972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946970940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946981907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.946990967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947000027 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947016001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947026968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947037935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947047949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947055101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947068930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947134972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947145939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947155952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947170019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947185993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947225094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947256088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947267056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947277069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947288990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947298050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947323084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947339058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947350979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947361946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947381020 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947402000 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947495937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947508097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947519064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947530031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947541952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947552919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947556973 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947565079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947575092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947586060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947588921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947607040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947626114 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947659969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947671890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947683096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947705030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947729111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947743893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947755098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947766066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947801113 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947901964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947912931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947922945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947933912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.947945118 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.947981119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962076902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962131023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962260008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962270975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962281942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962297916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962310076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962316990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962321043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962332010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962335110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962351084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962361097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962363005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962378979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962393999 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962404013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962414980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962419033 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962425947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962438107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962456942 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962466002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962475061 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962480068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962515116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962521076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962527037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962538958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962562084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962627888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962639093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962649107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962663889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962706089 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962728024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962739944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962752104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962769032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962779045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962783098 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962814093 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962841034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962852955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962877989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962881088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962917089 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.962951899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962964058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962975979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.962987900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963001013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963022947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963078022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963088989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963100910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963112116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963124037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963135958 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963174105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963205099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963243008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963267088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963278055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963319063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963368893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963380098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963390112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963402033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963412046 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963443995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963465929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963479042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963490009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963529110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963596106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963606119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963618994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963629007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963640928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963666916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963675022 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963679075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963701010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:12.963705063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:12.963747978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.022985935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023000002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023024082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023035049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023046970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023051023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.023056984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023077011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023077011 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.023092985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.023137093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023150921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023185968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.023217916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023228884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023243904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023255110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023255110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.023292065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.023310900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023329020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.023363113 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033000946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033019066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033029079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033051968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033071041 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033122063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033185005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033198118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033224106 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033246040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033260107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033296108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033313036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033325911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033361912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033441067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033483982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033489943 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033504009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033514977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033535004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033543110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033552885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033560038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033586025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033612013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033679962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033689976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033700943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033710957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033723116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033727884 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033732891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033746004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033768892 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033830881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033840895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033850908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033862114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033873081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033876896 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033893108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033915997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033927917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033938885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033951044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033952951 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033962965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033972979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.033972979 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.033998966 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.034061909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034073114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034082890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034100056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034106970 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.034118891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034125090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.034132004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034143925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034154892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034157991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.034167051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034177065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034183025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.034189939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.034197092 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.034240961 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048379898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048391104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048402071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048433065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048532963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048544884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048557043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048573017 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048589945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048610926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048624039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048660040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048707962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048718929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048729897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048741102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048754930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048757076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048798084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048872948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048885107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048897028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048907995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048914909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048923969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048934937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.048939943 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.048962116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049031973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049042940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049053907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049065113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049072981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049077988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049086094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049088955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049129009 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049246073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049257994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049273014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049283981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049288034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049303055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049308062 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049315929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049328089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049339056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049350977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049355030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049376011 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049386024 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049452066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049467087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049479008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049490929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049500942 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049509048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049520016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049525976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049530983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049542904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049551964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049554110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049591064 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049751043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049762964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049773932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049789906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049803972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049809933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049820900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049832106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049843073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049861908 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049875021 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.049976110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.049988031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.050000906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.050010920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.050025940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.050028086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.050035954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.050045013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.050066948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109211922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109235048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109245062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109272003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109282970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109301090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109328985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109330893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109342098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109373093 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109375954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109385967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109416962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109461069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109472036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109484911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109498024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109499931 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109519958 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109553099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109563112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109572887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109585047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.109590054 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.109615088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.119688988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.119699955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.119709969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.119733095 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.119746923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.119807005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.119817972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.119826078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.119837046 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.119859934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.119869947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.119929075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120023012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120033026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120043039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120053053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120058060 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120064020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120070934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120074034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120096922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120240927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120255947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120265007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120275021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120282888 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120286942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120297909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120306969 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120309114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120318890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120321989 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120330095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120340109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120348930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120352030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120361090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120368004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120372057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120388985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120405912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120484114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120577097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120587111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120596886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120606899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120615005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120639086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120714903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120726109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120734930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120745897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120753050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120755911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120767117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120778084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120783091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.120784998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120825052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.120843887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135546923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135557890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135567904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135590076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.135598898 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.135727882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135737896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135747910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135759115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135773897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.135776997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135795116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135797977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.135804892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135814905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135827065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135837078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135847092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135855913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135867119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.135870934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.135870934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.135870934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.135896921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136085033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136096001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136105061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136116028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136126041 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136133909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136143923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136147976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136153936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136164904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136166096 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136174917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136184931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136188984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136195898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136205912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136212111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136215925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136225939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136234045 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136253119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136401892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136429071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136439085 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136439085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136473894 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136605978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136616945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136626005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136636972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136646986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136650085 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136657953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136668921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136673927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136687994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136687994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136698008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136707067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136718035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136727095 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136728048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136740923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136742115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136753082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136763096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136764050 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136774063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136784077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136785984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136794090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136804104 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.136806011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.136826038 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.137085915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.137095928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.137120962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.189435005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.195590973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195609093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195620060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195663929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.195668936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195715904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.195739031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195749044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195759058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195785046 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.195851088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195863008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195873022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195883036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195890903 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.195894003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195913076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.195935965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.195945978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195956945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.195991039 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.205430984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205440044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205451012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205463886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205473900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205485106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205486059 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.205496073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205514908 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.205537081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.205584049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205601931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205622911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.205903053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205912113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205923080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205935001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.205946922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.205976963 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206002951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206015110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206022024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206027031 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206046104 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206074953 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206180096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206197023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206208944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206219912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206221104 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206231117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206242085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206250906 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206254959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206285000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206294060 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206296921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206307888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206309080 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206340075 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206425905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206444025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206455946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206466913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206466913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206478119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206490993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206521034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206547976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206558943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206569910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206581116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206590891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206605911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206633091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206763983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206775904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206792116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206813097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206813097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206825018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206835985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206841946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206847906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206859112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206865072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206870079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.206901073 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.206926107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.221635103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221678972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221688986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221715927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.221769094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221780062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221790075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221800089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221803904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.221826077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.221877098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221892118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221903086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221914053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.221915007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.221939087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222028017 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222038984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222049952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222062111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222064972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222074032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222084999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222089052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222111940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222131968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222141981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222151995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222187042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222193956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222203970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222213984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222223997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222238064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222248077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222276926 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222312927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222325087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222335100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222346067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222361088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222383976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222475052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222484112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222493887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222502947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222513914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222536087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222539902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222584963 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222604990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222615004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222656965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222696066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222704887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222714901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222724915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222740889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222764969 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222781897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222793102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222803116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222845078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222883940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222894907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222904921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.222922087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.222948074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.223012924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223023891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223035097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223045111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223061085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223072052 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.223073006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223084927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223098993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.223119974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.223155975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223167896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223177910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.223196983 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.223226070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.281953096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.281960964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.281970978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.281980991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.281990051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282006025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282016039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282026052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282036066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282040119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.282052994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282063961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282073975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282088995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.282105923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.282111883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282121897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282135010 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.282151937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282155037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.282161951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.282203913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.291774035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.291785955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.291795969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.291835070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.291850090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.291861057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.291870117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.291881084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.291894913 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.291924000 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292107105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292117119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292126894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292145967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292175055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292191982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292203903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292224884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292237043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292247057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292257071 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292267084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292444944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292454958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292465925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292478085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292486906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292490959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292498112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292507887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292515993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292517900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292529106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292537928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292550087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292552948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292562962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292572975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292579889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292596102 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292718887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292728901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292740107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292748928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292758942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292781115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292804003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292804956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292804956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292815924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292824984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292834997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292853117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292860031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.292870045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292912006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292922974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.292948961 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.293010950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.293020964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.293030977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.293041945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.293052912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.293059111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.293071032 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.293093920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.307990074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308001041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308012009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308023930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308089018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308099985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308104992 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308110952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308146954 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308173895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308185101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308196068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308207989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308270931 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308288097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308300018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308311939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308322906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308382034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308386087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308397055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308408022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308489084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308497906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308501959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308510065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308521032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308532953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308578014 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308645010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308656931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308667898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308680058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308691025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308701992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308757067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308777094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308862925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308868885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.308873892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308887005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308897018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308907986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308918953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.308993101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.309094906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309104919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309114933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309125900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309144020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309154987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309173107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309184074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309195042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309204102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309205055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.309222937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309226990 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.309272051 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.309302092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309314013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309324026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309334040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309345007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309382915 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.309392929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.309504032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309514999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309525967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309536934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309547901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309559107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.309607983 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.368213892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368223906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368241072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368251085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368262053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368269920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368279934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368288994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.368290901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368300915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368313074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368324041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368347883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.368370056 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.368453979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368463993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368474960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.368494034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.368521929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378087997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378098011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378108025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378125906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378135920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378149033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378154993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378160000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378171921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378202915 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378390074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378400087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378411055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378434896 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378454924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378465891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378474951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378490925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378492117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378515959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378552914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378567934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378592968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378596067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378603935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378612995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378631115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378649950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378739119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378748894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378758907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378798962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378802061 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378809929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378818989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378839970 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378865957 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378885984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378896952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378905058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378947020 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.378957987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378968954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.378978968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379002094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.379012108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.379072905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379084110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379093885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379102945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379117966 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.379137039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379147053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.379148006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379158020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379179001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.379328012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379338026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379348040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379359007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.379369020 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.379398108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394207954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394217968 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394227982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394292116 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394318104 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394364119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394373894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394383907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394428968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394449949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394459963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394476891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394486904 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394486904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394510984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394550085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394561052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394596100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394670963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394680977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394691944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394701004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394714117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394720078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394726992 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394731045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394742012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394757986 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394774914 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394826889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394843102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394851923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394862890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394871950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394876957 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394882917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394892931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394895077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394920111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.394968033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.394979000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395005941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395057917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395068884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395082951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395092964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395097017 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395103931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395116091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395138025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395212889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395222902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395232916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395256042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395320892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395330906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395339966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395356894 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395379066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395447969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395458937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395467997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395478964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395489931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395492077 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395499945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395509958 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395519972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395540953 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395652056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395662069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395672083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395682096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395688057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395690918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395700932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395709991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395710945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395720959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395728111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395755053 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.395802975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395813942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.395836115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.406678915 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.454351902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454363108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454374075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454410076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454421997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454433918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454447031 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.454504967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.454515934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454528093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454539061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454550982 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454561949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454572916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454582930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.454607964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.454653978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454664946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454677105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454714060 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.454734087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.454771996 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464263916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464323044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464332104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464368105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464379072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464389086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464397907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464410067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464417934 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464432001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464437008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464481115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464519024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464526892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464534044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464571953 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464586973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464596033 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464617014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464626074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464627981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464654922 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464709044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464719057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464730024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464739084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464744091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464777946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464802027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464812040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464828014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464838028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464843035 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464865923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464926004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464935064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464945078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464956045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.464966059 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464987040 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.464998960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465009928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465018988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465029955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465035915 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465056896 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465075016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465092897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465114117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465169907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465179920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465189934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465212107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465223074 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465347052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465358019 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465367079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465377092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465410948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465437889 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465456009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465467930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465485096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465495110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465508938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465517998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465534925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.465544939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.465584993 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480309010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480325937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480335951 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480385065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480392933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480402946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480412960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480433941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480439901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480451107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480501890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480510950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480526924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480535984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480537891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480560064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480566025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480576038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480591059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480600119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480632067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480653048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480667114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480676889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480701923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480704069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480711937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480731010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480735064 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480767965 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480772972 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480837107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480846882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480859041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480874062 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480879068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480889082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480896950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480921030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.480957985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480968952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.480979919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481005907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481146097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481157064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481167078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481178045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481189013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481189013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481201887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481206894 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481211901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481220961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481230021 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481241941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481386900 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481396914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481408119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481416941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481421947 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481427908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481437922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481440067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481461048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481519938 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481530905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481540918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481549978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481558084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481559992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481578112 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481604099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481673002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481683969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481693029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481703043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481713057 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481720924 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481745958 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481769085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481779099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481790066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481798887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481802940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481810093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481825113 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481847048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.481981039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.481992006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.482017994 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.540740013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540750980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540760994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540801048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540803909 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.540812969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540822029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540832043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540838003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.540852070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.540950060 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540961027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540971041 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540981054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.540990114 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.540991068 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.541002989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.541013956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.541019917 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.541032076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.541059971 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.550465107 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550484896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550497055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550530910 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.550549030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550559044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550570011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550584078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.550609112 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.550630093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550640106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550676107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.550708055 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550760984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550770044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550791025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.550951004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550985098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.550993919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551002026 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551007986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551018953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551028013 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551054001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551139116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551150084 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551160097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551171064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551179886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551181078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551203012 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551286936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551301956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551316023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551326036 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551328897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551337004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551352024 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551373959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551441908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551453114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551462889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551472902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551482916 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551484108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551493883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551506996 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551532030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551553965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551565886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551600933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551635981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551646948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551656961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551666975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551681042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551702976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551824093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551836014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551843882 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551853895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551863909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551872969 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551877022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.551894903 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.551919937 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566555977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566576004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566585064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566636086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566637039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566651106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566662073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566673040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566684961 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566703081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566729069 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566749096 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566760063 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566766977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566793919 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566818953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566829920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566859961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566864967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566871881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566905022 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.566941023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566951990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566963911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566975117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.566982985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567011118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567014933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567056894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567068100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567094088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567167997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567178011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567188025 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567198038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567199945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567218065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567226887 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567245960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567256927 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567306042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567321062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567329884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567346096 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567356110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567420959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567430973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567441940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567451954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567471027 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567487001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567626953 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567636967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567646980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567656994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567673922 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567682981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567684889 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567691088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567696095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567706108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567717075 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567728043 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567734003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567756891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567768097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567802906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567929983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567939997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567950964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567965984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567975998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567981005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.567981005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.567992926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568022966 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.568048000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568058014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568068981 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568078995 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568090916 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.568109035 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.568111897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568123102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568131924 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.568151951 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.568176985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.627578974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627589941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627602100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627629995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.627753973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627768993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627779007 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627789974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627799988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627800941 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.627830029 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.627835989 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.627850056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627861977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627873898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627885103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627896070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627897978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.627904892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.627918959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.627940893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.636859894 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.636873960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.636883974 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.636921883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.636925936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.636935949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.636945963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.636980057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.636998892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637005091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637327909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637346983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637356997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637368917 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637387991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637396097 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637490034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637501001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637511015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637521029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637527943 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637558937 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637566090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637576103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637603045 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637690067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637701035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637711048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637720108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637729883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637731075 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637739897 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637752056 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637784004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637797117 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637840033 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637840986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637851954 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637887955 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637923956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637936115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637945890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637955904 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.637973070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.637999058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.638076067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638087034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638097048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638108015 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638118029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638122082 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.638128042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638139009 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638145924 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.638149023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638160944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638170004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.638194084 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.638276100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638287067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.638308048 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.653662920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653680086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653691053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653703928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653716087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653717995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.653759956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.653803110 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653814077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653825998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653836966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653848886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653865099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.653891087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.653944016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653956890 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.653985977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654042959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654056072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654067993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654078960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654083014 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654089928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654102087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654109001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654145956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654331923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654344082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654356003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654366970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654373884 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654380083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654391050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654397964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654402018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654413939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654418945 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654429913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654442072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654449940 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654453993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654465914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654469967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654495001 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654537916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654551029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654562950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654596090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654609919 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654696941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654709101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654721022 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654731035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654742956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654755116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654766083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654769897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654771090 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654793978 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654798985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654812098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654822111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654834032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654836893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654844999 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654854059 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654855967 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654867887 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654879093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654884100 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654891014 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.654917955 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.654944897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.655086040 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.655105114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.655116081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.655143976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.655308008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.655328989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.655358076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.705046892 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.713283062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.713293076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.713303089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.713350058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.720787048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720799923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720809937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720839977 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.720840931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720853090 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720864058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720870018 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.720877886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720889091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.720896959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.720912933 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.721302032 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.721344948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.721354008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.721365929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.721400023 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.722971916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.722994089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723004103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723031998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723046064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723059893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723087072 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723088026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723099947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723124027 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723156929 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723167896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723195076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723577976 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723588943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723599911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723623037 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723647118 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723664045 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723675966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723686934 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723697901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723711967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723741055 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723771095 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723781109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723792076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723814964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723824024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723834991 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723845005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723860025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723885059 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723913908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723931074 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723943949 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723954916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.723965883 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.723984003 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724004030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724064112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724088907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724112988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724162102 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724176884 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724188089 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724203110 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724224091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724302053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724313021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724324942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724335909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724349976 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724374056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724374056 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724385977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724396944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724407911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724420071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724426985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724446058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724504948 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724515915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724525928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724538088 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724548101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.724554062 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724567890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.724596024 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.739860058 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740037918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740053892 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740063906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740072966 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740082026 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740091085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740106106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740108967 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740117073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740127087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740138054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740142107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740148067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740175962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740179062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740196943 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740207911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740210056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740215063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740243912 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740253925 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740268946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740278959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740312099 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740325928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740339994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740350962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740365982 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740394115 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740401030 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740451097 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740459919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740470886 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740483046 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740504980 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740536928 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740546942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740557909 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740566969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740593910 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740623951 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740631104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740678072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740688086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740715027 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740777969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740788937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740797997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740808964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740817070 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740843058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740868092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740878105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740888119 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740911007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740917921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740927935 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.740977049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.740988016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741018057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741075039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741086006 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741095066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741105080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741117001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741141081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741141081 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741163969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741173983 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741174936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741211891 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741215944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741226912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741261005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741373062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741383076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741390944 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741401911 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741417885 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741420984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741427898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741437912 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.741439104 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.741461992 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.783194065 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.807060957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807079077 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807087898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807135105 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.807167053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807178020 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807188034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807215929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.807246923 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.807394028 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807420969 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807431936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807440996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807451010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807460070 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807465076 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.807471037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807481050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.807486057 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.807498932 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.807518005 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.809298992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809324980 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809334993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809365034 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.809408903 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809420109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809428930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809433937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809453964 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.809477091 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.809938908 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809948921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809958935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.809983015 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810004950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810013056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810024023 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810034037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810044050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810056925 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810086966 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810162067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810173035 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810183048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810194016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810204029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810209036 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810228109 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810262918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810283899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810301065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810307980 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810312986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810345888 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810472965 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810482979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810493946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810517073 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810518026 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810527086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810537100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810538054 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810547113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810555935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810568094 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810570955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810589075 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810615063 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810741901 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810751915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810760975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810770988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810781002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810790062 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810791016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810801029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810803890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810811996 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810822010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810825109 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810832977 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.810857058 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.810894012 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837224960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837245941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837285995 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837428093 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837443113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837454081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837462902 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837472916 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837483883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837487936 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837507010 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837532997 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837582111 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837593079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837603092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837611914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837622881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837627888 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837632895 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837645054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837654114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837656975 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837677956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837692022 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837846994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837857962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837873936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837898970 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837902069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837909937 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837918997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837929010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837939024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837940931 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837949038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837959051 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837965012 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837973118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837982893 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.837990046 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.837992907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838004112 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838009119 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838033915 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838043928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838150978 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838161945 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838171959 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838196039 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838282108 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838290930 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838299990 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838310957 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838315964 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838325024 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838330030 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838335037 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838346004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838361025 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838372946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838414907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838426113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838434935 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838447094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838454008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838455915 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838466883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838473082 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838476896 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838486910 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838496923 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838501930 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838509083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838522911 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838542938 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838784933 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838797092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838804960 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.838831902 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.838851929 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.893126011 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893171072 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893182993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893223047 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.893309116 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893323898 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893335104 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893345118 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893356085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893358946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.893377066 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.893413067 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.893470049 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893480062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893493891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893520117 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.893554926 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893567085 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893577099 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893588066 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.893614054 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.893626928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.895519018 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.895530939 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.895541906 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.895567894 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.895596981 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.895601988 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.895615101 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.895625114 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.895636082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.895675898 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896100998 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896125078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896135092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896152973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896163940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896173000 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896217108 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896230936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896240950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896276951 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896290064 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896301985 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896312952 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896323919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896332026 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896348000 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896384001 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896398067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896425962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896441936 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896455050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896481991 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896518946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896529913 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896539927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896552086 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896560907 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896563053 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896588087 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896605968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896742105 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896754026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896764994 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896774054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896784067 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896799088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896811962 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896815062 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896826029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896836042 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896847010 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896852970 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896861076 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896872044 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896874905 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896908998 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896924973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896935940 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896945000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.896960974 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.896996975 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.897006989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.897017002 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.897027016 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.897047043 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.897056103 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.897099972 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924057961 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924069881 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924081087 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924117088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924194098 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924205065 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924216986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924238920 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924271107 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924319983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924330950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924340963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924351931 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924361944 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924390078 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924446106 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924458027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924503088 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924588919 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924598932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924608946 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924624920 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924637079 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924642086 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924649000 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924665928 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924685955 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924725056 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924741983 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924751997 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924777985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.924901962 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924913883 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.924943924 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925075054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925086021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925096989 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925107956 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925138950 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925214052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925225973 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925235987 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925249100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925257921 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925261021 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925268888 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925280094 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925285101 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925291061 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925302029 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925304890 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925313950 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925332069 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925374985 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925517082 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925529003 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925539017 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925549984 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925565004 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925587893 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925709963 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925726891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925739050 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925784111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925846100 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925858021 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925868034 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925879955 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.925884008 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.925909042 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.926007986 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926019907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926034927 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926044941 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926049948 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.926058054 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926079988 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.926086903 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.926187038 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926203012 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926213026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926223993 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926234007 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.926235914 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.926265955 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.970693111 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.979926109 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980062008 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980072975 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980083942 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980093956 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980098009 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.980106115 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980120897 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.980146885 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.980179071 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980190039 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980200052 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980218887 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.980365992 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980376005 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980391979 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980402946 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.980405092 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980417013 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980427027 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.980427980 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.980453968 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982117891 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982127905 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982137918 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982150078 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982155085 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982160091 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982171059 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982178926 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982182026 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982193947 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982209921 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982228041 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982333899 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982358932 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982374907 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982378006 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982410908 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982433081 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982444048 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982501984 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982505083 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982517004 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982553959 CET	49732	8888	192.168.2.4	130.61.86.87
Jan 3, 2025 08:53:13.982597113 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982608080 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982619047 CET	8888	49732	130.61.86.87	192.168.2.4
Jan 3, 2025 08:53:13.982630968 CET	8888	49732	130.61.86.87	192.168.2.4

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	130.61.86.87	8888	7400	C:\Users\user\Desktop\test.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 08:53:09.534595966 CET	159	OUT	GET /leo_uwu.jpg HTTP/1.1 Host: 130.61.86.87:8888 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Jan 3, 2025 08:53:10.185396910 CET	190	IN	HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.10.12 Date: Fri, 03 Jan 2025 07:53:10 GMT Content-type: image/jpeg Content-Length: 22760 Last-Modified: Thu, 26 Sep 2024 12:26:44 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	130.61.86.87	8888	7400	C:\Users\user\Desktop\test.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 08:53:10.303618908 CET	159	OUT	GET /silence.mp3 HTTP/1.1 Host: 130.61.86.87:8888 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Jan 3, 2025 08:53:10.932771921 CET	193	IN	HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.10.12 Date: Fri, 03 Jan 2025 07:53:10 GMT Content-type: audio/mpeg Content-Length: 15279697 Last-Modified: Sat, 23 Nov 2024 11:34:15 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	130.61.86.87	8888	7400	C:\Users\user\Desktop\test.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 08:53:22.159681082 CET	159	OUT	GET /example.zip HTTP/1.1 Host: 130.61.86.87:8888 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Jan 3, 2025 08:53:22.789705038 CET	197	IN	HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.10.12 Date: Fri, 03 Jan 2025 07:53:22 GMT Content-type: application/zip Content-Length: 1499142 Last-Modified: Sat, 23 Nov 2024 12:08:02 GMT

Target ID:	0
Start time:	02:52:59
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\test.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\test.exe"
Imagebase:	0x7ff716700000
File size:	62'866'063 bytes
MD5 hash:	120AABD78079A8792013AFB29779C425
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	02:53:06
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\test.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\test.exe"
Imagebase:	0x7ff716700000
File size:	62'866'063 bytes
MD5 hash:	120AABD78079A8792013AFB29779C425
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00007FF716708BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF716709400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7167045E4,00000000,00007FF716701985), ref: 00007FF716709439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708C46

Part of subcall function 00007FF71671A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71671A500

Part of subcall function 00007FF71671878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7167187F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708CD6
CreateProcessW.KERNELBASE ref: 00007FF716708D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708D18

Part of subcall function 00007FF716702C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702C9E
Part of subcall function 00007FF716702C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D63
Part of subcall function 00007FF716702C50: MessageBoxW.USER32 ref: 00007FF716702D99

RegisterClassW.USER32 ref: 00007FF716708D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708D7B
CreateWindowExW.USER32 ref: 00007FF716708DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E05
PeekMessageW.USER32 ref: 00007FF716708E29
TranslateMessage.USER32 ref: 00007FF716708E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E41
PeekMessageW.USER32 ref: 00007FF716708E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF716709009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716709012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF71670901F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF716708D85
Failed to create child process!, xrefs: 00007FF716708D20
PyInstallerOnefileHiddenWindow, xrefs: 00007FF716708D44
CreateProcessW, xrefs: 00007FF716708D27

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: a26c13260e8690a1f107172321a1eca8371806eeff93485115b50203827f3ae4
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 68D16631A08E4286EB10AF74EC642BBB765FB89B68F900235DA5D43695DF3CE54DC720

Function 00007FF716701000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MEI, xrefs: 00007FF716703933
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF716703971
Failed to convert DLL search path!, xrefs: 00007FF716703DDC
Failed to start splash screen!, xrefs: 00007FF716703ED4
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF716703EBB
Failed to remove temporary directory: %s, xrefs: 00007FF716703FC3
pyi-disable-windowed-traceback, xrefs: 00007FF716703BB2
Failed to load splash screen resources!, xrefs: 00007FF716703E85
VCRUNTIME140.dll, xrefs: 00007FF716703DB1
pyi-python-flag, xrefs: 00007FF716703AD6
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF716703A0B, 00007FF716703CD4, 00007FF716703F6B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF716703E0A
Py_GIL_DISABLED, xrefs: 00007FF716703AF4
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF716703A17, 00007FF716703A2F, 00007FF716703A9B
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF716703882, 00007FF7167038AF
pyi-contents-directory, xrefs: 00007FF716703B8D
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF716703EA6
_PYI_ARCHIVE_FILE, xrefs: 00007FF7167038D2, 00007FF7167039FF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7167039DE
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF716703B32
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF716703BE8
pyi-runtime-tmpdir, xrefs: 00007FF716703B68
_PYI_SPLASH_IPC, xrefs: 00007FF716703A23, 00007FF716703EF5
Could not create temporary directory!, xrefs: 00007FF716703CBF
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF716703D35
pkg, xrefs: 00007FF7167039BE
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF716703C61
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF716703D12

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 0e7f9f8f9b7973c5112ddf8e6b7b04449a78dc6e1f1e844403fce0d1da25eb6d
Instruction ID: c50545c63dd69791a517a96d1e9afb1c5974ab27aaaa4c0ab6f88a151ca3e123
Opcode Fuzzy Hash: 0e7f9f8f9b7973c5112ddf8e6b7b04449a78dc6e1f1e844403fce0d1da25eb6d
Instruction Fuzzy Hash: D3328C61A08E8391FA25BB259C743BBA251AF5E7B4FC44136DA5D422C6EF2CE55CC330

Function 00007FF716725C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF716725CB5

Part of subcall function 00007FF716725608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672561C

Part of subcall function 00007FF71671A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
Part of subcall function 00007FF71671A9B8: GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

Part of subcall function 00007FF71671A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF71671A94F,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671A979
Part of subcall function 00007FF71671A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF71671A94F,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671A99E

_get_daylight.LIBCMT ref: 00007FF716725CA4

Part of subcall function 00007FF716725668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672567C

_get_daylight.LIBCMT ref: 00007FF716725F1A
_get_daylight.LIBCMT ref: 00007FF716725F2B
_get_daylight.LIBCMT ref: 00007FF716725F3C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71672617C), ref: 00007FF716725F63

Strings

Eastern Standard Time, xrefs: 00007FF716726009
Eastern Summer Time, xrefs: 00007FF716726021

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: eeccce077fa5dd4c450a14936c9fb0f99f3dccb1ffe5436e136368c338f57a25
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: 8DD1C232A08A5246F720BF229C615BBA752EF4C7B4FD0813ADA0E47695DF3CE44D8760

Function 00007FF7167269D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF716726708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716726749
Part of subcall function 00007FF716726708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7167267C7
Part of subcall function 00007FF716726708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716726818

CreateFileW.KERNELBASE ref: 00007FF716726ADA
CreateFileW.KERNEL32 ref: 00007FF716726B2A
GetLastError.KERNEL32 ref: 00007FF716726B5A
GetFileType.KERNELBASE ref: 00007FF716726B6F
GetLastError.KERNEL32 ref: 00007FF716726B79
CloseHandle.KERNEL32 ref: 00007FF716726BAC
CloseHandle.KERNEL32 ref: 00007FF716726D0F
CreateFileW.KERNEL32 ref: 00007FF716726D44
GetLastError.KERNEL32 ref: 00007FF716726D53

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: b892d9b6f7a9a48c52265414bba7c0a0dd2f7508eb98364cb03945893dddfe18
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 2DC1D432B24E5186EB10EF64C8A02AD7762F74DBA8F91422ADE2E577D4CF38D459C310

Function 00007FF716725EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF716725F1A

Part of subcall function 00007FF716725668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672567C

_get_daylight.LIBCMT ref: 00007FF716725F2B

Part of subcall function 00007FF716725608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672561C

_get_daylight.LIBCMT ref: 00007FF716725F3C

Part of subcall function 00007FF716725638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672564C

Part of subcall function 00007FF71671A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
Part of subcall function 00007FF71671A9B8: GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71672617C), ref: 00007FF716725F63

Strings

Eastern Standard Time, xrefs: 00007FF716726009
Eastern Summer Time, xrefs: 00007FF716726021

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: cab2d58c9e65ebd30314507a811a7c5ca0cd7c9620af7c4432cf8e02a1315b8c
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: CD514332A18A5286E720FF22DCA156BE752FB4C7A4FC4413ADA4D47696DF3CE44C8760

Function 00007FF7167092F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF716709323
FindClose.KERNELBASE ref: 00007FF716709332

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: d3e27e22025f41329e34c933c3bc2eafa4604812b569e43f929f01a679eb1b3e
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: F6F04426A18B4286F760AB60BCA9767E750EB8D778F841235D96D026D4DF3CE04D8A10

Function 00007FF716720938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: 86739b534c6deb527af8bb70910ec0bcab2742e6feabc68037443c70470d7188
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 9D02AC21A0EE4241FA66BB119C3427BA692EF0DBB0FD58639DD6D063D1DE3DA45D8330

Function 00007FF716701950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF716707F80: _fread_nolock.LIBCMT ref: 00007FF71670802A

_fread_nolock.LIBCMT ref: 00007FF716701A1B

Part of subcall function 00007FF716702910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF716701B6A), ref: 00007FF71670295E

Strings

fseek, xrefs: 00007FF7167019F5
calloc, xrefs: 00007FF716701A68
Error on file., xrefs: 00007FF716701B8D
Could not allocate memory for archive structure!, xrefs: 00007FF716701A61
MEI, xrefs: 00007FF716701991
Could not allocate buffer for TOC!, xrefs: 00007FF716701B1B
Failed to read cookie!, xrefs: 00007FF716701A2B
Could not read full TOC!, xrefs: 00007FF716701B55
malloc, xrefs: 00007FF716701B22
fread, xrefs: 00007FF716701A32, 00007FF716701B5C
Failed to seek to cookie position!, xrefs: 00007FF7167019EE

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 16f991fcb6eafa2be328405e4c3fd0f8092fcf390c23f96bae780e3482a46c31
Instruction ID: e47e3a87c894850033a2b92db58620e8f29929f413eed35b8815390981aec7bb
Opcode Fuzzy Hash: 16f991fcb6eafa2be328405e4c3fd0f8092fcf390c23f96bae780e3482a46c31
Instruction Fuzzy Hash: 9E819071A08E8285E720FB64EC602BBA3A1EB4D755F844536E98D43785DF3CE58D8770

Function 00007FF716701600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF7167016E1
Failed to extract %s: failed to open target file!, xrefs: 00007FF71670165C
Failed to create symbolic link %s!, xrefs: 00007FF716701622
fopen, xrefs: 00007FF716701663
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7167017DF
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7167017CA
fwrite, xrefs: 00007FF7167017D1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7167016DA
malloc, xrefs: 00007FF716701749
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7167016A2
fread, xrefs: 00007FF7167017E6
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF716701742

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: b4dce51a2f15d4256ca8ebf38f0ef0f5c6c1e815475986c4f8aee27c3ae6b2b4
Instruction ID: a4ace5358b9bea0fd86c1399ecdb2989f4b8b1843b2547bab31030aa2e4e8852
Opcode Fuzzy Hash: b4dce51a2f15d4256ca8ebf38f0ef0f5c6c1e815475986c4f8aee27c3ae6b2b4
Instruction Fuzzy Hash: 14515B61B08E4782EA10BB51AC201BBA391BF49BB8FC44536EE5C07796DF3CE55D8760

Function 00007FF716708850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF716703CBB), ref: 00007FF7167088F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF716703CBB), ref: 00007FF7167088FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF716703CBB), ref: 00007FF71670893C

Part of subcall function 00007FF716708A20: GetEnvironmentVariableW.KERNEL32(00007FF71670388E), ref: 00007FF716708A57
Part of subcall function 00007FF716708A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF716708A79

Part of subcall function 00007FF7167182A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7167182C1

Part of subcall function 00007FF716702810: MessageBoxW.USER32 ref: 00007FF7167028EA

Strings

TMP, xrefs: 00007FF71670888C, 00007FF716708993
TMP, xrefs: 00007FF7167088B2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF71670896E
_MEI%d, xrefs: 00007FF716708902
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7167088CC

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: d8a55d06be04c0b6820d2ceb560a06c01cfff70698beb34f6ec3e60c19130c10
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: 3E41B152A19E4244FA10FB25AC752BB9291AF8EBA4FD55032ED0D477DADE3CE50C8730

Function 00007FF716701210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF71670141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7167012EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF716701276
1.3.1, xrefs: 00007FF716701249
malloc, xrefs: 00007FF7167012C1, 00007FF7167012F6
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7167012BA

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction ID: 697e7fca25b16e91c7e380fecd4e09e8072b5dd4b95371e43fc2d14b5493a906
Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction Fuzzy Hash: B551B162A08A4241E660BB51AC603BBE291FB8EBA8FC44135ED4D47795EF3CE54DC720

Function 00007FF7167036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF716703804), ref: 00007FF7167036E1
GetLastError.KERNEL32(?,00007FF716703804), ref: 00007FF7167036EB

Part of subcall function 00007FF716702C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702C9E
Part of subcall function 00007FF716702C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D63
Part of subcall function 00007FF716702C50: MessageBoxW.USER32 ref: 00007FF716702D99

Strings

\\?\, xrefs: 00007FF71670375A
Failed to resolve full path to executable %ls., xrefs: 00007FF716703739
Failed to convert executable path to UTF-8., xrefs: 00007FF716703790
Failed to obtain executable path., xrefs: 00007FF7167036F3
GetModuleFileNameW, xrefs: 00007FF7167036FA

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: ea6b0847aa7cc2419e831e488f02ee8773f974b0fccf99a48144e7d9a28f7ad6
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: C5216D61B18E4381FA60B720EC613B7A251BF9E774FC05136E56D826D6EE2CE50C8770

Function 00007FF71671BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671BEF9

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction ID: e5990355003ea47aa8678b3176bd6bf55337f3e96eb649a8ee08f8b82a365da0
Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction Fuzzy Hash: 45C108A290CE8681E720AB1598602BFB764FB89FA0FD54136EA5D03795CF7CE54D8720

Function 00007FF716708760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF716708780
OpenProcessToken.ADVAPI32 ref: 00007FF716708793
GetTokenInformation.KERNELBASE ref: 00007FF7167087B8
GetLastError.KERNEL32 ref: 00007FF7167087C2
GetTokenInformation.KERNELBASE ref: 00007FF716708802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF71670881E
CloseHandle.KERNEL32 ref: 00007FF716708836

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 8555396abfa03a269e30c4c153e951f3a21e15fc4f1caf7f6ba17e8e34faec20
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 7F214421A18E4241EA10BB55FC6423BE3A1EB89BB4F900235E66D437E4DF6CD44C8720

Function 00007FF7167090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF716708760: GetCurrentProcess.KERNEL32 ref: 00007FF716708780
Part of subcall function 00007FF716708760: OpenProcessToken.ADVAPI32 ref: 00007FF716708793
Part of subcall function 00007FF716708760: GetTokenInformation.KERNELBASE ref: 00007FF7167087B8
Part of subcall function 00007FF716708760: GetLastError.KERNEL32 ref: 00007FF7167087C2
Part of subcall function 00007FF716708760: GetTokenInformation.KERNELBASE ref: 00007FF716708802
Part of subcall function 00007FF716708760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF71670881E
Part of subcall function 00007FF716708760: CloseHandle.KERNEL32 ref: 00007FF716708836

LocalFree.KERNEL32(?,00007FF716703C55), ref: 00007FF71670916C
LocalFree.KERNEL32(?,00007FF716703C55), ref: 00007FF716709175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF716709183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF716709142
D:(A;;FA;;;%s), xrefs: 00007FF716709157
S-1-3-4, xrefs: 00007FF716709121

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 99c74a4d52315fb42bd55e99e472b995ded13158fd6dd8ac4b851532f6881a15
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: D6213922A08F4281E610BB10ED252EBA265FF8D7A0FD45035EA4D53B96DF3CD84D8770

Function 00007FF716707E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF71670352C,?,00000000,00007FF716703F23), ref: 00007FF716707F22

Strings

%.*s, xrefs: 00007FF716707EDB
%s%c, xrefs: 00007FF716707E94
\, xrefs: 00007FF716707E87

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
Instruction ID: dea5989b1a452373019d2717daa4ce8ef6ab6aaf14aedc9999b5fa8f788a5f06
Opcode Fuzzy Hash: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
Instruction Fuzzy Hash: 15317521619EC145EA21BB21AC607FBE354EB89BF4F841231EA6D477C9DE3CD64D8720

Function 00007FF71671CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71671CFBB), ref: 00007FF71671D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71671CFBB), ref: 00007FF71671D177

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 53dc846ddf2e997a6f05c34aacaea0f86a8843df5bcaecb50d2e0561f182ed96
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 2291C8B3F18A5145F750FF659C6027EABA0AB48BA8F94413ADE0D53685DE3CD44DCB20

Function 00007FF71671F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF71671FAEC
_get_daylight.LIBCMT ref: 00007FF71671FAFD
_get_daylight.LIBCMT ref: 00007FF71671FB0E
_isindst.LIBCMT ref: 00007FF71671FBD9

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 3ecbe8114eb67ebe3b10bd514a3515ef1dd1e04d8207934ba43a7029b5411b1e
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 40510BB2F0891186FB24EF389D716BDA7E1AB18378F910136DD1E52AE5DB3CA44D8710

Function 00007FF7167157EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF71671581F
GetFileInformationByHandle.KERNELBASE ref: 00007FF716715881
GetLastError.KERNEL32 ref: 00007FF716715912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF716715724), ref: 00007FF71671595E

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 1b5e07b5b398da429095c78699f3cbd7dcb7c2f6aef57cef4dbb6a210240c813
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 8051B2E2E14A418AFB14EF71D8603BEA3A5FB48B68F584436DE0D57689DF38D44C8721

Function 00007FF716715698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167156C5
CreateFileW.KERNELBASE ref: 00007FF716715704
CloseHandle.KERNEL32 ref: 00007FF716715739

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction ID: b30f8ac1ba44c428d4ca140d455de6c3cd77f4a1d1d7cb64d0e96e14d217f70c
Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction Fuzzy Hash: 3041D9A2D18B8183F314AB20996137AA360FB98774F548336E65C03AD1DF7CA5EC8760

Function 00007FF71670CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71670CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71670CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71670CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF71670CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF71670CD91

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: e1dc6125a54463fd03684d86fdcfd65195af9a56f7ac1127a4604da339cabd76
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 6E314721E48E0341FA24BB649C723BBA782AF4A7A8FD44435D90D4B2D7DE2CA44DC271

Function 00007FF7167101AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167101F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167102E7

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 54eae8b4cd0c1a73e58d81b1fa6bd815b1cc54da5eeeefe951fd4b79ecc9bea9
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 1151C7A1B09A4146EA26BA359C2067BE291BF4CBB4F944736EE6C477C5CF3CD44DC620

Function 00007FF71671C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF71671C33D), ref: 00007FF71671C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF71671C33D), ref: 00007FF71671C1FA

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: ec7ff3ac686da093c1522ff3d4d6ad6d4e8d1e0d4108f1b0e014117b4e8d2e23
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: E511C4A1718E4181DA10AB65AC2417AA361FB49BF4F944332EE7D4B7D9CF7CD01D8700

Function 00007FF716715994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7167158A9), ref: 00007FF7167159C7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7167158A9), ref: 00007FF7167159DD

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction ID: 00c7ee29b0ea046034a1f514507933e2a8396b804e43b746d8e2ab3ce725b98f
Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction Fuzzy Hash: 571194B261CA1282FA546B14A86113BF760FB88771F900236F69D419D8EF3CD05CCB20

Function 00007FF71671A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 14cd26a99e5f55e9baa4bf979cf7b734dadf526da71620df8649b61fd0db2a69
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 44E04F91E09A0342FF14BBB25C7513A9291AF8CB61FC50035D81D422A2DE2C688D8620

Function 00007FF71671ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF71671AA45,?,?,00000000,00007FF71671AAFA), ref: 00007FF71671AC36
GetLastError.KERNEL32(?,?,?,00007FF71671AA45,?,?,00000000,00007FF71671AAFA), ref: 00007FF71671AC40

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 84009b94f8943afb3bfb307c4162a3d8321c96e489dd1ba43eb0ae390bf472b5
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 13216561B1CE4242EAA477619C7527B92C29F9C7B4F884237DD2E473D5CE6CA44D8310

Function 00007FF71671BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671BF44

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: 5d48cf34536a668f5467f58eae7138b63d299794641a2128cf48a08d91e130f1
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 68411DB2918A0147EA34BB15AD6017BF3A4EB5DB60F900133DA9D436D1CF2DE40ECB60

Function 00007FF716707F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF71670802A

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: c7509c5c59c4a666db98ff03363a6938e2dccbe5af1fc5850b6eda6e7b6e2098
Instruction ID: 0d7e03befb6bcc61f1d83fd356ccb62ddde6a9ad96167c932536fcc12e82ca78
Opcode Fuzzy Hash: c7509c5c59c4a666db98ff03363a6938e2dccbe5af1fc5850b6eda6e7b6e2098
Instruction Fuzzy Hash: 62218021B1DA9285EE10BA226D243BBD651BF4ABE4FCD5431EE4D07786CE3DE04DC620

Function 00007FF71671B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671BA32

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 1c90275a2246e46690b0003f37790a97333f98431cb5a96ab8160f87d9bc8b6e
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: 1C318BA1A18A4286E7517B558C6127EA664AB48FB4FD60136EA2D073D2CF7CA44D8730

Function 00007FF716716004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716715F69

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: bcc62871db6ab0e75e888d3455619fcec663d8d6fcad2caea3db266cf6869af4
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 401165A2A18A4141FA647F11982017FE2A8BF49BA0FC84032FB5C57795DF3DD54C8B20

Function 00007FF7167263C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167263E7

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 2b069f39fa3a3d27441ed7fd246a2db8f794d3c236129da6408c6ce543c04580
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: E721CC72618E4147DB61AF28D86037AB6A1FB88B74F944239EB9D476D5DF3CD40C8B10

Function 00007FF71671042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716710480

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 7994d96825c36c208c21f7175deb8c2f1602f3dd014b3bdca12676abadbd8adc
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: CA01A5A1B08B4140E905FF529D1106AE695BF9AFF0F8C4632EE5C17BDACE3CD0198310

Function 00007FF716717F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716717FAA

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction ID: 8a3faf64b05f81cc8e776a17406522b801213cacfa5397409694071e387cce79
Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction Fuzzy Hash: 62016DA0A0DE4240FE607A216D6117BD598AF0C7B0FD54137FA3C526C6DF3CA45E8A31

Function 00007FF7167182A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167182C1

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 090d3f81b0e400e80d315ffbb5679f63bc162346afee209a078bf4b3391b5aab
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: 01E08CE1E08E0382FA117BA40CA227B90245F4D370FC64532E918063C3DE6CA84D4A31

Function 00007FF71671EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF71671B39A,?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA), ref: 00007FF71671EC5D

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: 5163834989e72895af2e5f1e6e4d77350cf583ec21b96a175beb0b683dd2869c
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 94F04F94B09A0641FE547E665C712B79695AF4CBA0FCC4A32C90D463D1DE1CA48D4230

Function 00007FF71671D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF716710D00,?,?,?,00007FF71671236A,?,?,?,?,?,00007FF716713B59), ref: 00007FF71671D6AA

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: c742166b22e4176d568eb6ba419f1a0d18a70e52a56f47ef0a1c12ca51f6efa3
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 98F03A92B09B0A45FE5476715C61276A2909F5CBF0F880232982E453C2EE2CA54C8930

Non-executed Functions

Function 00007FF716705820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705830
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705842
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705879
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670588B
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058A4
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058B6
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058CF
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058E1
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058FD
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670590F
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670592B
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670593D
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705959
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670596B
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705987
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705999
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167059B5
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167059C7

Strings

PySys_SetObject, xrefs: 00007FF716705E85, 00007FF716705EA7
PyConfig_SetBytesString, xrefs: 00007FF716705A07, 00007FF716705A29
PyModule_GetDict, xrefs: 00007FF716705CB9, 00007FF716705CDB
PyUnicode_FromFormat, xrefs: 00007FF716705F3D, 00007FF716705F5F
Failed to get address for %hs, xrefs: 00007FF716705851
PyImport_ExecCodeModule, xrefs: 00007FF716705C01, 00007FF716705C23
PyErr_Restore, xrefs: 00007FF716705B77, 00007FF716705B99
PyConfig_SetWideStringList, xrefs: 00007FF716705A63, 00007FF716705A85
PyConfig_SetString, xrefs: 00007FF716705A35, 00007FF716705A57
PyRun_SimpleStringFlags, xrefs: 00007FF716705DFB, 00007FF716705E1D
PySys_GetObject, xrefs: 00007FF716705E57, 00007FF716705E79
PyEval_EvalCode, xrefs: 00007FF716705BA5, 00007FF716705BC7
PyImport_AddModule, xrefs: 00007FF716705BD3, 00007FF716705BF5
Py_PreInitialize, xrefs: 00007FF71670594F, 00007FF716705971
Py_DecodeLocale, xrefs: 00007FF71670586F, 00007FF716705891
PyUnicode_FromString, xrefs: 00007FF716705F6B, 00007FF716705F8D
PyConfig_Clear, xrefs: 00007FF71670597D, 00007FF71670599F
Py_Finalize, xrefs: 00007FF7167058C5, 00007FF7167058E7
PyObject_SetAttrString, xrefs: 00007FF716705D71, 00007FF716705D93
Py_ExitStatusException, xrefs: 00007FF71670589A, 00007FF7167058BC
PyErr_Fetch, xrefs: 00007FF716705ABF, 00007FF716705AE1
PyMarshal_ReadObjectFromString, xrefs: 00007FF716705C5D, 00007FF716705C7F
PyErr_Clear, xrefs: 00007FF716705A91, 00007FF716705AB3
PyConfig_InitIsolatedConfig, xrefs: 00007FF7167059AB, 00007FF7167059CD
PyObject_GetAttrString, xrefs: 00007FF716705D43, 00007FF716705D65
PyUnicode_Decode, xrefs: 00007FF716705EE1, 00007FF716705F03
PyErr_Occurred, xrefs: 00007FF716705B1B, 00007FF716705B3D
PyObject_Str, xrefs: 00007FF716705D9F, 00007FF716705DC1
GetProcAddress, xrefs: 00007FF716705858
Py_DecRef, xrefs: 00007FF716705826, 00007FF716705848
PyUnicode_Join, xrefs: 00007FF716705F99, 00007FF716705FBB
PyErr_NormalizeException, xrefs: 00007FF716705AED, 00007FF716705B0F
PyStatus_Exception, xrefs: 00007FF716705E29, 00007FF716705E4B
PyObject_CallFunction, xrefs: 00007FF716705CE7, 00007FF716705D09
PyMem_RawFree, xrefs: 00007FF716705C8B, 00007FF716705CAD
PyErr_Print, xrefs: 00007FF716705B49, 00007FF716705B6B
PyObject_CallFunctionObjArgs, xrefs: 00007FF716705D15, 00007FF716705D37
PyConfig_Read, xrefs: 00007FF7167059D9, 00007FF7167059FB
Py_IsInitialized, xrefs: 00007FF716705921, 00007FF716705943
PyUnicode_DecodeFSDefault, xrefs: 00007FF716705F0F, 00007FF716705F31
PyUnicode_AsUTF8, xrefs: 00007FF716705EB3, 00007FF716705ED5
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF716705DCD, 00007FF716705DEF
Py_InitializeFromConfig, xrefs: 00007FF7167058F3, 00007FF716705915
PyUnicode_Replace, xrefs: 00007FF716705FC7, 00007FF716705FE9
PyImport_ImportModule, xrefs: 00007FF716705C2F, 00007FF716705C51

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 3436543a43fb2ccc36599d98619d80e594eb4bf1e0d5ec4b303503bc178f0785
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: A122B424A19F0781FA55BB94AE74576A3A2EF1DB79FD45039C81E023A0EF7CB14C8270

Function 00007FF71672411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF71672416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167247D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71672494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716724C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716724E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716725067
memcpy_s.LIBCPMT ref: 00007FF716725142
memcpy_s.LIBCPMT ref: 00007FF7167251ED
memcpy_s.LIBCPMT ref: 00007FF7167252BC

Strings

1#SNAN, xrefs: 00007FF71672427A
1#QNAN, xrefs: 00007FF716724283
1#IND, xrefs: 00007FF716724257
1#INF, xrefs: 00007FF716724293

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 846c0c35047894e3526afcd36b7a1a79c369765c206109e083e691c02403519b
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: 9BB2FA72E196928BE724DF24D9607FEB7B2FB48354F901139DA0D57A88DB38A50CCB50

Function 00007FF7167083B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF71670841B
RemoveDirectoryW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF71670849E
DeleteFileW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084BD
FindNextFileW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084CB
FindClose.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084DC
RemoveDirectoryW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084E5

Strings

%s\*, xrefs: 00007FF7167083E2

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: da10b20d8122475c7c25776bfc12ddf93457d5ff052d52d4fe8d705e1b4174e4
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: F5417121A0CD4295EE20BF24EC641BBA364FB99764FC10236E99D42684DF3CE54D8720

Function 00007FF71670AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF71670B6E0
invalid distances set, xrefs: 00007FF71670B210
invalid distance code, xrefs: 00007FF71670B624
invalid code -- missing end-of-block, xrefs: 00007FF71670B136
invalid literal/length code, xrefs: 00007FF71670B452
invalid literal/lengths set, xrefs: 00007FF71670B1A3
too many length or distance symbols, xrefs: 00007FF71670AEB6
invalid code lengths set, xrefs: 00007FF71670AE9D
invalid bit length repeat, xrefs: 00007FF71670B109

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: dcfb6f711ffb654cea72a8d60415528448902c40b1ee35d26d65ed4791a8825b
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: 1E522872A14AA687D754BF14CC68B7E77A9FB49710F414238EA4A87780DB3DD94CCB20

Function 00007FF71670D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF71670D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF71670D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71670D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF71670D240
IsDebuggerPresent.KERNEL32 ref: 00007FF71670D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71670D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71670D2BC

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 089968030c76bc1ff7d2f57d1ba8c9303b82550cc9ada657a64990e42ce8504e
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: D5310D72608F8185EB60EF60EC903AEA3A5FB89758F444439DA4D46A94DF38D54C8720

Function 00007FF71671A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF71671A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71671A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF71671A750
IsDebuggerPresent.KERNEL32 ref: 00007FF71671A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71671A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71671A79E

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: de361c8913b9271ed45663c42412d1d03309e316d0ccfab33e2f7a5a95f25370
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 2C314176618F8185D760EB25EC502AFB3A5FB89768F94013AEA8D43B58DF38D14D8B10

Function 00007FF7167218E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716721930
FindFirstFileExW.KERNEL32 ref: 00007FF716721A3A

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: 2caae054d9db6abd9433848c0e6bcc4b17899a0a2ac82cb9e01b0ada408d2793
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: C7B1A959B18A9241EA61AB21AC205BBE362FB4CBF5F845136DF4D07B85DE3CE44DC710

Function 00007FF71670D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF71670D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF71670D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF71670D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF71670D0D6

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 0138b2fdf2c950d4c8a0ebe0085680264c38521c83aa46736ea555ed98c21f35
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 61111C26B14F058AEB00DB60EC652BA73A4FB1DB68F840E35DA6D867A4DF78D15C8350

Function 00007FF716723C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF716723CE6
memcpy_s.LIBCPMT ref: 00007FF716723D11

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 757fd45e2e2bdc5b70d79cb03069f25363956118a8d08b92225df534bfc393a5
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 73C11572B19A8687D7249F19E45466BF7A2F7987A4F809138DB4E43744DB3DE848CB00

Function 00007FF71670A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF71670A535
header crc mismatch, xrefs: 00007FF71670A991
, xrefs: 00007FF71670A5CB

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: 6fc57fcbd8625164add173da809117672574c390d708cddfd705f87c1456455c
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: 7BF19362A14BC58BE795BF188C98B3BBAA9FF4A750F454238DE4907391CB38D54CC760

Function 00007FF716729798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7167299E7
RaiseException.KERNEL32 ref: 00007FF7167299F8

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: 3becf6b1fbc884cc1e4c458de20ecbed92843c2aebbdf60cd7d2c62c838f59c4
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: 27B1A173A04B848BE715CF2AC85236D77E1F788BA8F188825DB9D837A4CB39D459C710

Function 00007FF716713A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF716713B82
, xrefs: 00007FF716713DC4

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: 0c7fc350eb9348a2ae665e2a97f9db33538cbc020f71ebacae350fc1a6509966
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: 58E1B8B2908E4685EB78AE25896013EB360FF4DB74FA44237DA4E076D4DF29D84DC710

Function 00007FF71670A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF71670A4CB
invalid window size, xrefs: 00007FF71670A4B2

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: b5e68442c1f24f483d0fc5b2fff85e6676113631b621b4df5ff5c3f2145ec254
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: 9491F972A186C687E7A4BE14CC58B3F7A99FB49760F514239DA4A463C1CB39E54CCB20

Function 00007FF71671DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF71671E06D
gfff, xrefs: 00007FF71671E0EA

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: 975350ffc5630191d5e408c676f042b80d1782b3c5a72c6e88346a30c0e5203d
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: A3515DB2B28AC546E7249F359C2076AA7D1F748BA4F988632CB6847AC5CF3DD04DC710

Function 00007FF71671DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF71671DE0E

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 58b70a2c8a6fd3c81371997e8095809b538b8daea50c0199cd07e1458eeb2ebb
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: C6A179A3B08BC546EB21EF25A8207AABB91EB58794F508133DE8D47781DE3DD50DCB10

Function 00007FF716718804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF716718823

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 35dc2a772e02af6faafccf9b5f5267ae671cb9e96783e0797d7a6f4efcaef864
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: 8851B095F18A4242FB64BA265D3117BD291AF8CBA4FCA4136DE1D477C6EE3CE44D8220

Function 00007FF7167234F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7167234F4

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: b40f472646bc643f4a9fb4396b889fb3f4cd04a069b916370532c1f9b9cbec03
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 84B09220E07F02C2EA08BB226C9622A62A5BF5CB21FD80138C00C40330DF2C20ED5720

Function 00007FF716713610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: 853bc5199bb6f957f727969d6080ccf24b4c9abea184a4283b2e3dac44604c4e
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: 09D1CAE6A08E4686EB289E25887027FA760EB09B78F944237CD0D57794DF3DD84DC760

Function 00007FF716709870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: 841470972b7beb22225531c6e16eaf51c26a175e7124c57333fb2c92fa8b6175
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: 4CC19E762181E08BD28AEA29E87947A73D1F78930DBD5406BEF87477C5C63CA418DB20

Function 00007FF716712C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: cdf88ca36734a12c2ca09f19c6a45f69b3d80eaf6867336311bb48d686c6c1d9
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: BEB1C1F2A08B8185E7649F38C86413EBBA4E70DB58FA48136CA6D47395CF39D58DC720

Function 00007FF71671E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 59d792651a8354932448c9f1b2bd330ec3b501dccf60c2c23d4e146b18bad03b
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: 2F81F9B2A0CB8146E774EF19986037BB691FB497A4F904636DB8D43B95DE3CD44C8B10

Function 00007FF716726488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction ID: 4790e4840eadc8d5bd8638ef186d4676baee61988591b4da50baac38dba84dac
Opcode Fuzzy Hash: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction Fuzzy Hash: 7761FB62E0C9A247F724AA298C7423FE582EF49770F94423FD71D466C5EE6DE84C8720

Function 00007FF716711DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: e8970ce71e34ec7756fd2c4c840dedd6dc94541d71c1ef230c6334c1ed3862e1
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 4A51CEB6A19E5181E7249B29D46023973A0EB4CF7AF644132CE4C4BB94CF3AE94FC750

Function 00007FF7167119B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 17ca205eec1a0c4442b9a1377f06a5bd159e970de4517db32f8c308d64bfbcaf
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: F151A9B6A18E5181E7249B29E46023A77A0EB4CF79F644132CE4D1B794DF3AE84FC750

Function 00007FF7167121D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: ea34758db0cfbd215134863cb3a7d319382983d34fb79120aecffca25e99d732
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: D05196F2A28A5185E724DB29C45023E73A0EB5DB78F658132CE5C077D4CB3AE88BC750

Function 00007FF7167117B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 5e555613a177bb3fef02061fec98c81e72c94e82b7fa079b9a9c56ff2c871b4f
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 4651ABB6A14A5186E7249B18E46033E67A1EB48F79F649132CE4C1B794CF39E84EC750

Function 00007FF716711FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 76afbd0c64e72ece21d0dccb2569b0596e4559b26b50d29541a684034b8e1766
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 09519CF6628E5185E7249B19C86023A77A0EB4CF68F648132CE5D17794CF3BEC8AC750

Function 00007FF716711BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 4d722a26bef98833b5747b905994ea6024c595fcaba86f6b16274cb31858df14
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 0D51B8B2A18E5185E7249F29D46023A67A1EB4CF69FA44132CE4C1B794CF3AE84FC750

Function 00007FF716715DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 64cc7cfd6e489741b6e1f5f300d3db244f9a818610d06a58ad9f901ddb1c73c8
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 1841E9E2C19F4A44F9AD99680C207BAD7809F26BB0DDC1276CCA9573C3DD0C6A4EC621

Function 00007FF716719F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: a3d9d41bf733232b345bb202f96f418b74d0619ec82c8012e33475e14d2fbe38
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: 3141E462724E5581EF04DF2ADE2426AB391BB4CFE0B899437DE0D97B54DE3DC44A8700

Function 00007FF716718154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 8c29dad77d191032618e61eb352110c63c9c46915c28431bd7046f189e60bc74
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: CE31E472B08F4282E755AB216C5012FAAD5AB88BA0F85423EEA5D53BD5DF3CD0098314

Function 00007FF7167295E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: 78bce8dbf476e504acb8f8bc82f411d4c7d2a56509b1ef1c06085f7d810d31fe
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: 38F068727186558ADBA89F69A85262A77D0F70C3D0F809039D58D83B04DB3CD0658F14

Function 00007FF71670D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: a45506c81c0a5dd89ea0043c5187279f7604b7e0aad5bff70f5a9276da45ea1e
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: F3A0016290CE0AD0E648AB10ACA003AE362FB5D724B800039E00D410A09F2CA40C9220

Function 00007FF7167076B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7167076C7
GetLastError.KERNEL32 ref: 00007FF7167076D9
GetProcAddress.KERNEL32 ref: 00007FF716707715
GetLastError.KERNEL32 ref: 00007FF716707727
GetProcAddress.KERNEL32 ref: 00007FF716707740
GetLastError.KERNEL32 ref: 00007FF716707752
GetProcAddress.KERNEL32 ref: 00007FF71670776B
GetLastError.KERNEL32 ref: 00007FF71670777D
GetProcAddress.KERNEL32 ref: 00007FF716707799
GetLastError.KERNEL32 ref: 00007FF7167077AB
GetProcAddress.KERNEL32 ref: 00007FF7167077C7
GetLastError.KERNEL32 ref: 00007FF7167077D9
GetProcAddress.KERNEL32 ref: 00007FF7167077F5
GetLastError.KERNEL32 ref: 00007FF716707807
GetProcAddress.KERNEL32 ref: 00007FF716707823
GetLastError.KERNEL32 ref: 00007FF716707835
GetProcAddress.KERNEL32 ref: 00007FF716707851
GetLastError.KERNEL32 ref: 00007FF716707863

Strings

Tcl_ConditionFinalize, xrefs: 00007FF71670792D, 00007FF71670794F
Tcl_SetVar2, xrefs: 00007FF716707A41, 00007FF716707A63
Tcl_NewStringObj, xrefs: 00007FF716707ACB, 00007FF716707AED
Failed to get address for %hs, xrefs: 00007FF7167076E8
Tcl_ThreadQueueEvent, xrefs: 00007FF7167079B7, 00007FF7167079D9
Tcl_JoinThread, xrefs: 00007FF716707875, 00007FF716707897
Tcl_ConditionNotify, xrefs: 00007FF71670795B, 00007FF71670797D
Tcl_NewByteArrayObj, xrefs: 00007FF716707AF9, 00007FF716707B1B
Tk_GetNumMainWindows, xrefs: 00007FF716707C97, 00007FF716707CB9
Tcl_CreateInterp, xrefs: 00007FF71670770B, 00007FF71670772D
Tcl_ConditionWait, xrefs: 00007FF716707989, 00007FF7167079AB
Tcl_EvalObjv, xrefs: 00007FF716707BDF, 00007FF716707C01
Tcl_CreateObjCommand, xrefs: 00007FF716707A6F, 00007FF716707A91
Tcl_GetCurrentThread, xrefs: 00007FF716707847, 00007FF716707869
Tcl_MutexLock, xrefs: 00007FF7167078A3, 00007FF7167078C5
Tcl_Free, xrefs: 00007FF716707C3B, 00007FF716707C5D
Tcl_GetObjResult, xrefs: 00007FF716707B55, 00007FF716707B77
Tcl_GetVar2, xrefs: 00007FF716707A13, 00007FF716707A35
Tcl_MutexUnlock, xrefs: 00007FF7167078D1, 00007FF7167078F3
Tcl_DoOneEvent, xrefs: 00007FF716707761, 00007FF716707783
Tcl_EvalFile, xrefs: 00007FF716707B83, 00007FF716707BA5
GetProcAddress, xrefs: 00007FF7167076EF
Tcl_CreateThread, xrefs: 00007FF716707819, 00007FF71670783B
Tcl_Init, xrefs: 00007FF7167076C0, 00007FF7167076DF
Tcl_GetString, xrefs: 00007FF716707A9D, 00007FF716707ABF
Tcl_MutexFinalize, xrefs: 00007FF7167078FF, 00007FF716707921
Tcl_Finalize, xrefs: 00007FF71670778F, 00007FF7167077B1
Tcl_FinalizeThread, xrefs: 00007FF7167077BD, 00007FF7167077DF
Tcl_DeleteInterp, xrefs: 00007FF7167077EB, 00007FF71670780D
Tcl_Alloc, xrefs: 00007FF716707C0D, 00007FF716707C2F
Tcl_SetVar2Ex, xrefs: 00007FF716707B27, 00007FF716707B49
Tcl_FindExecutable, xrefs: 00007FF716707736, 00007FF716707758
Tcl_EvalEx, xrefs: 00007FF716707BB1, 00007FF716707BD3
Tcl_ThreadAlert, xrefs: 00007FF7167079E5, 00007FF716707A07
Tk_Init, xrefs: 00007FF716707C69, 00007FF716707C8B

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: bea7286a7ae161293756abb8cc1dc15c91457cd2728c3f0e5d728c7a1608a662
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: FD02A321A1EF0791EA15BB55AD745B6E3A2EF1DB79FD41039D81E022A0EF3CB54D8230

Function 00007FF7167081C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF716709400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7167045E4,00000000,00007FF716701985), ref: 00007FF716709439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7167088A7,?,?,00000000,00007FF716703CBB), ref: 00007FF71670821C

Part of subcall function 00007FF716702810: MessageBoxW.USER32 ref: 00007FF7167028EA

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7167082C9
%.*s, xrefs: 00007FF7167082FC
\, xrefs: 00007FF716708251
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7167081F3
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF71670828D
CreateDirectory, xrefs: 00007FF71670836C
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF716708363
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF716708230

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: e5ebef0a2cb08dfe76a06f297fda623f67086e7d319359f7a169c0b04650ee3a
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: 49517122A18E4281EB50FB21EC716BBE251EF9D7A0FD44435D90E866D5EE2CE50C8770

Function 00007FF716702180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7167021AB
SelectObject.GDI32 ref: 00007FF7167021F2
DrawTextW.USER32 ref: 00007FF716702215
SelectObject.GDI32 ref: 00007FF71670222B
ReleaseDC.USER32 ref: 00007FF71670223B
MoveWindow.USER32 ref: 00007FF71670228B
MoveWindow.USER32 ref: 00007FF7167022CB
MoveWindow.USER32 ref: 00007FF71670231E
MoveWindow.USER32 ref: 00007FF716702366

Strings

P%, xrefs: 00007FF7167021FF

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: ade0606709fd40a6a902563c40cd238d7e4b99d77ea7d0ef8b600ced5211661b
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: FB51F626614BA186D634AF22A8581BBB7A1F79CB65F004125EFDE43694DF3CD049CB20

Function 00007FF7167080B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7167080EF
GetWindowLongPtrW.USER32 ref: 00007FF71670816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF716708182
GetLastError.KERNEL32 ref: 00007FF71670818C
SetWindowLongPtrW.USER32 ref: 00007FF7167081A3

Strings

Needs to remove its temporary files., xrefs: 00007FF716708175

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: aea34c27e282c0624d302ef0732ff3d20d6e42cb4d2e121fcb37174a97192862
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: AE21A621B18E4282EB517B7AAC6417AA251FF8DFB4F994235DA2D433D4DF2CD59C8230

Function 00007FF716716300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716716343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716716730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167169CC

Strings

p, xrefs: 00007FF71671646D
f, xrefs: 00007FF716716465
p, xrefs: 00007FF7167163F5
:, xrefs: 00007FF7167164FC
-, xrefs: 00007FF7167163D9

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 4c706a7dd7498be6fafee1df948a81b32cc7753a536156dd8c3f0275407faabf
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 741283A2E0D96386FB207B14D97427BF6A1FB58760FC44137D699466C4DB3CE58C8B20

Function 00007FF716711038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716711078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716711440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167116DF

Strings

f, xrefs: 00007FF716711110
p, xrefs: 00007FF716711182
p, xrefs: 00007FF71671111D
f, xrefs: 00007FF7167112C5
f, xrefs: 00007FF71671117A

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: ff1b0b04904ed9818d8209860e18f5e84427a92b8fcd4a7cec66239927743cb1
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: C51293B1E0C94785FB20BA15F86467BE261FB44765FC84037E6994AAC4DF7DE48C8B20

Function 00007FF716701050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF7167010D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7167011F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7167010CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF716701108
malloc, xrefs: 00007FF71670110F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF716701098
fread, xrefs: 00007FF7167011FD

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 59c6c80ce575ec5ad76b0cd759d21567f01197dabd19b036127b21c1b0ac61c1
Instruction ID: 5bada9bf95e6475cc9fdae14d69a8634f50c2d369a8bc188d173cffb5964eae1
Opcode Fuzzy Hash: 59c6c80ce575ec5ad76b0cd759d21567f01197dabd19b036127b21c1b0ac61c1
Instruction Fuzzy Hash: 28418E61B08A5282EA04FB51AC206BBE395FF5EBA4FC44432ED5C07785DE3CE14D8760

Function 00007FF716701470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF7167014E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7167015DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7167014DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF716701518
malloc, xrefs: 00007FF71670151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF71670149F
fread, xrefs: 00007FF7167015E6

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 281f9259771b2aa61f8cb8999354d07f10fb55b2d14c1a354ed8c762e1bd5e15
Instruction ID: ac0e70a48790b556d9c67cec0dda28d7cfb4f1351f3041d67ec0683abfe498b1
Opcode Fuzzy Hash: 281f9259771b2aa61f8cb8999354d07f10fb55b2d14c1a354ed8c762e1bd5e15
Instruction Fuzzy Hash: 5F418126B08A4285EA00FB61AC601B7E390FF4D7A8FC44436ED5D07B99DE3CE54D8760

Function 00007FF71670EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF71670EAD5

Part of subcall function 00007FF71670FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF71670FA6F
Part of subcall function 00007FF71670FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF71670FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF71670EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF71670EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71670EF08

Strings

csm, xrefs: 00007FF71670EB56
csm, xrefs: 00007FF71670EBD0
csm, xrefs: 00007FF71670EAEF

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 0f6fa424f94d91053cf61cfff396d2ba13e4a1c648d7f6e2d50330bf76628ad0
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 29D16F72908B4186EB20FB25DC603AEA7A0FB4A7A8F500535EE4D57795DF38E58DC720

Function 00007FF71671ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF71671F11A,?,?,00000262519069E8,00007FF71671ADC3,?,?,?,00007FF71671ACBA,?,?,?,00007FF716715FAE), ref: 00007FF71671EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF71671F11A,?,?,00000262519069E8,00007FF71671ADC3,?,?,?,00007FF71671ACBA,?,?,?,00007FF716715FAE), ref: 00007FF71671EF08

Strings

ext-ms-, xrefs: 00007FF71671EE59
api-ms-, xrefs: 00007FF71671EE46

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: d822d982001ad4d534cdc7b653913ce22771d6d6b0e5203dec187c649175903b
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: 6A41D2A1B29E1241FA16EB169C24676A391BF4DBB0FD8493ADD1D57384EF3CE54C8320

Function 00007FF716702C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D63
MessageBoxW.USER32 ref: 00007FF716702D99

Strings

Error, xrefs: 00007FF716702D8C
%ls: , xrefs: 00007FF716702D22
[PYI-%d:ERROR] , xrefs: 00007FF716702CA6
<FormatMessageW failed.>, xrefs: 00007FF716702D70

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 78248fc368abc303673d8bf1ff02c5260d9c55dba35123e527228ae1bb84a96b
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 9831A773704E4142E620BB15AC602ABA695BF8DBA8F804135DF4D53759DF3CD54EC720

Function 00007FF71670DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DDBD
GetLastError.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DE63
GetProcAddress.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DE6F

Strings

api-ms-, xrefs: 00007FF71670DDDD

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: e1e42b01de42037910fbefba20b4b971679530161ab25c3e4cf460bea3cedd30
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: 83315022B1AB4291EE12BB12AC2057AE394FF5DBB4F994539DD1D46380EF3CE44C8634

Function 00007FF716706350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7167063F7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7167063B7
Failed to load Python DLL '%ls'., xrefs: 00007FF716706497
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF716706446
ucrtbase.dll, xrefs: 00007FF7167063CD
LoadLibrary, xrefs: 00007FF71670649E

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
Instruction ID: fd36a0f3c4505a6755a59b77667fc507f4e509fb877e1af8c0628fd85e3d3567
Opcode Fuzzy Hash: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
Instruction Fuzzy Hash: DD415D21A18E86A1EA11FB60EC742EBA311FB59364FD00132EA5D43695EF3CE64DC770

Function 00007FF716702A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF71670351A,?,00000000,00007FF716703F23), ref: 00007FF716702AA0

Strings

WARNING, xrefs: 00007FF716702AAF
0, xrefs: 00007FF716702B16
Warning, xrefs: 00007FF716702B1E
Warning [ANSI Fallback], xrefs: 00007FF716702B0F
[PYI-%d:%s] , xrefs: 00007FF716702AA8

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 6ea6a585244da4c52085459eca779fc4d0c0004916727137f5f5ae08259463e2
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 38217F72A18B8192E620AB51BCA17E7A394FB8C7A4F800136FE8C43659DF3CD14D8750

Function 00007FF71671B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF71671B1CF
FlsGetValue.KERNEL32 ref: 00007FF71671B1E4
FlsSetValue.KERNEL32 ref: 00007FF71671B205
FlsSetValue.KERNEL32 ref: 00007FF71671B232
FlsSetValue.KERNEL32 ref: 00007FF71671B243
FlsSetValue.KERNEL32 ref: 00007FF71671B254
SetLastError.KERNEL32 ref: 00007FF71671B26F

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: c1d193bbe3b73c5404641a4403bd630be2d81b20281281ae0fac3a9e61e3d3d7
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: D72159A0E0CE0241FA64B7615E7113FD1825F4CBB0F804636D93E46AD6DE2CE44C8320

Function 00007FF716727DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF716727E0D
GetLastError.KERNEL32 ref: 00007FF716727E19
CloseHandle.KERNEL32 ref: 00007FF716727E31
CreateFileW.KERNEL32 ref: 00007FF716727E5C
WriteConsoleW.KERNEL32 ref: 00007FF716727E7B

Strings

CONOUT$, xrefs: 00007FF716727E3D

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 6fcd257559399ea3a1fba6e006344e14f45dff6ea1b452fa62e98ce8ed28dfed
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: D3114221A18E4186E750AB56AC6433AE7A1FB8CFF4F844238E95D877A4DF7CD84C8750

Function 00007FF716708560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF716709216), ref: 00007FF716708592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF7167085E9

Part of subcall function 00007FF716709400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7167045E4,00000000,00007FF716701985), ref: 00007FF716709439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF716708678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF7167086E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF7167086F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF71670870A

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: d63eb840bafcfebbad8625b645733a6b79d05b1b2c8cd6315441541fb4c6c08b
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: AC41C666B19A8241EA30BB11AD606ABA394FB8DBE4F851035DF4C57789DE3CD44DC730

Function 00007FF71671B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B347
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B37D
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3CC
SetLastError.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3E7

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: a5b58c8b6e9f3b6f6fc026d3baa23165824ebe5e88658f3896f261de67e45af1
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: 5A1118A0A0CE4286FA5477355E7113BE1829F5CBB0FC44736E82E466D6DF2CE45E8321

Function 00007FF716702910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF716701B6A), ref: 00007FF71670295E

Strings

%s: %s, xrefs: 00007FF7167029E8
Error, xrefs: 00007FF716702A0E
Error [ANSI Fallback], xrefs: 00007FF7167029FF
[PYI-%d:ERROR] , xrefs: 00007FF716702966

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 77d671f8268e7583f659903bcba1f1797a64d33e7eb3d2f85b4d074fd01bbaf4
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: 4C31B763B18A8152E710B751AC606E7A295BF8D7E4F804136FE8D83755DF3CD54E8620

Function 00007FF716702390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7167023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF71670248E
DeleteObject.GDI32 ref: 00007FF7167024C1
DestroyIcon.USER32 ref: 00007FF7167024D3

Strings

Unhandled exception in script, xrefs: 00007FF7167023F8

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 8fba3d429930fccf4cc57a87ec7850e97f3857fb4ff614e2b72586677bc8bf04
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: 14315072619A8189EB20BF21EC652FAA360FF8D798F940135EA4D47B59DF3CD14C8720

Function 00007FF716702B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF71670918F,?,00007FF716703C55), ref: 00007FF716702BA0
MessageBoxW.USER32 ref: 00007FF716702C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF716702BA8
Warning, xrefs: 00007FF716702C1D
WARNING, xrefs: 00007FF716702BAF

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 56b0bf2ce7aea90e8b6708b16d6087e033323ceca105d29d4cd4b7ed78de6855
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 8D21BF72718B4182E610AB14BC907EBA3A5EB8C794F804136EA8D53659DF3CE24DC720

Function 00007FF716702710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF716701B99), ref: 00007FF716702760

Strings

Error, xrefs: 00007FF7167027DE
ERROR, xrefs: 00007FF71670276F
Error [ANSI Fallback], xrefs: 00007FF7167027CF
[PYI-%d:%s] , xrefs: 00007FF716702768

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 98ad92210f71b29199db1ac20b5655f222f1d05a399784ec07c6631b7b8d8aa9
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: F1218172A18B8182E720EB50BC917E7A394EB8C7A4F800136FE8C43659DF7CD14D8760

Function 00007FF716719AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF716719B1D
GetProcAddress.KERNEL32 ref: 00007FF716719B33
FreeLibrary.KERNEL32 ref: 00007FF716719B5A

Strings

mscoree.dll, xrefs: 00007FF716719B14
CorExitProcess, xrefs: 00007FF716719B2C

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 7de3022525665aa5f3e208cc058122673767c9683a112a3687016bc0a5826c8a
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 2BF04F61A19E0691FA20AB24ACA537B9321EF4DB75F940239C66E465E4DF2CE48DC360

Function 00007FF7167293D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF716729400
_set_statfp.LIBCMT ref: 00007FF71672941B
_set_statfp.LIBCMT ref: 00007FF716729437
_set_statfp.LIBCMT ref: 00007FF716729473

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 404f75141a7452899725cbdc86dd2bd3fd3738c4ccf1ffa57d9eabcfb7e33c0d
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: E5118F62E5CE1341F6543126DC76377A046EF5D3F4E8C063CEA7E062D68E2CA94D4124

Function 00007FF71671B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B41F
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B43E
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B466
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B477
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B488

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: 08b0404f650ad8fdc6ec91a533ca726000f91c5c402714747874d7350874ea0e
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: 781129A0A18E4241FA58B7255E7117BE1825F9CBB0F888737ED3E466D6DE2CE44D8220

Function 00007FF71671B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF71671B2A5
FlsSetValue.KERNEL32 ref: 00007FF71671B2C4
FlsSetValue.KERNEL32 ref: 00007FF71671B2EC
FlsSetValue.KERNEL32 ref: 00007FF71671B2FD
FlsSetValue.KERNEL32 ref: 00007FF71671B30E

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: 0e0e4b4598a5b696b851bcd66be88b7d9a5da50fadafd6a68d78e93fb29d7166
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: 931106A0A18E0646F958B3354C7117BD1824F5D730FC44B37D93E4A2D2DE2CF44E5221

Function 00007FF716716010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716716176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671622C

Strings

verbose, xrefs: 00007FF716716020

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 5db0d2eb34ca3e6bbf177a1c467ae4fd62c45c0e26a2522f32c69f2c4abed661
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: DD91AFB2A08E6681E761AF24DC6077EB2A5AB48BA4FC44137DA5D433D5DF3CE44D8321

Function 00007FF71671FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671FF17

Part of subcall function 00007FF716717AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716717AC9

Strings

ccs, xrefs: 00007FF71671FE52
UTF-16LEUNICODE, xrefs: 00007FF71671FEB5
UTF-8, xrefs: 00007FF71671FE96

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: fa24f7c794279cf06141c2ac47d8456dffe4ec6647f0c2b17e46be19c2cc2283
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 9B81FBF1E0CE4285F7646F2D893023BB7E0AB29764FE54037C94947289DB2DE50D9721

Function 00007FF71670D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71670D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF71670D77A
RtlUnwindEx.KERNEL32 ref: 00007FF71670D7D4

Strings

csm, xrefs: 00007FF71670D761

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 7d50d14651083d5245bf4d36752daf065943a455d6b2002d27b958d4c6e6189f
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 1C51A233A19B028ADB14FB15DC6467EB791EB49BA8F945134DA4E43784DF3CE849C720

Function 00007FF71670EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF71670EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF71670EFF3

Strings

RCC, xrefs: 00007FF71670EFC3
MOC, xrefs: 00007FF71670EFBB

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 34f8f237ec834366318ef66088819a5028571243bf79ce6f66b0194223f06588
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: CA618172908BC581D760EB15EC503AAB7A0FB89BA4F444225EF9C07B55DF7CD198CB20

Function 00007FF71670F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71670F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF71670F408

Strings

csm, xrefs: 00007FF71670F45A
csm, xrefs: 00007FF71670F342

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 707ba565ec8244538f68b976111ac3986c5930dcdb0f55ebf3ae910e7f1cff4c
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 8451C532508B4286EB74BE299D6436AB690FB5ABA4F944135EE4C43785CF3CE49CC721

Function 00007FF716702810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7167028EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF716702868
ERROR, xrefs: 00007FF71670286F
Error, xrefs: 00007FF7167028DD

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 6866c0ec36ffe8b1e66e1a361c8d7f1548e954d5eae0c870d709db9cf9688bfe
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: D5219C72B18B4182E610AB54BC947EBA3A5EB8C794F804136EA8D53659DF3CE24DC720

Function 00007FF71671C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF71671C68F
WriteFile.KERNEL32 ref: 00007FF71671C957
WriteFile.KERNEL32 ref: 00007FF71671C99D
GetLastError.KERNEL32 ref: 00007FF71671CA53

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 4b06dd4dac768b06849eaafdeca527620ae9f0f7bc7214b0174c042cb180d858
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 7ED126B2B18A408AE711DFA5D8502AD7771FB487A8B848236CE5D57B89DE3CD01EC750

Function 00007FF7167020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7167020F4
SetWindowLongPtrW.USER32 ref: 00007FF716702116
GetWindowLongPtrW.USER32 ref: 00007FF716702140
InvalidateRect.USER32 ref: 00007FF716702160

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: f560160375906010e84032e048ac135db81479a89c703f8fc38da08b41d866b9
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: DB11E932B1C94242F654B769ED9427B9292EF8DBA4FC4C030DB5907B89CD3DE48D8230

Function 00007FF716725B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7167217D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716721803

_get_daylight.LIBCMT ref: 00007FF716725CA4
_get_daylight.LIBCMT ref: 00007FF716725CB5

Strings

?, xrefs: 00007FF716725C35

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: 7ab6cae60b8b882024e75ae6ab7c365556f05004dd8163edb7793db969b5f8ea
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: E1414C12A08A8242F724A725D86137BD651EB88FB4F944239EE5D06AD5EF3CD48DC710

Function 00007FF716719084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167190B6

Part of subcall function 00007FF71671A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
Part of subcall function 00007FF71671A9B8: GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF71670CC15), ref: 00007FF7167190D4

Strings

C:\Users\user\Desktop\test.exe, xrefs: 00007FF7167190C2

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\test.exe
API String ID: 3580290477-580434538
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 9d511bf25b5e70320a7fbaef502707723e17ea35c907996b6c0129a8b399bc5d
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: 6C418271A08F4286E715BF259C610BEA794EB4C7E0BD54036EA4D47B85DE3DE58E8320

Function 00007FF71671CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF71671CDBF
GetLastError.KERNEL32 ref: 00007FF71671CDE1

Strings

U, xrefs: 00007FF71671CD6B

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: bbc9a43fb8501ca036f2436a7dbeaa02c02a3743b2ffae6075dd2be46d7c03bd
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: 3641C772B18A4181DB20AF65E8543BAA761FB8C7A4F944036EE8D87798DF3CD409C760

Function 00007FF71671F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF71671F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF71671F6BA

Strings

:, xrefs: 00007FF71671F67E

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: f0c5dcdf64fd39a4ddc791664c5a7586e9f689180a03a1b9ce2ae7008c850c2c
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: BC21F962608A4181EB20AB15D86426FA3F1FB9CB54FD54036D64C43694DF7CD54D8B60

Function 00007FF71670FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF71670FE08
RaiseException.KERNEL32 ref: 00007FF71670FE49

Strings

csm, xrefs: 00007FF71670FE36

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: cec4f2ed7c556955b2bb65d1e527b0f0f83627fece8ba17d51a7d6520fddc0ee
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: C2114C32608F8182EB609B19F85026AB7E1FB88B98F984234DF8D07759DF3CD5598B10

Function 00007FF7167207AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167207DC
GetDriveTypeW.KERNEL32 ref: 00007FF71672081C

Strings

:, xrefs: 00007FF716720805

Memory Dump Source

Source File: 00000000.00000002.2897154822.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000000.00000002.2897123408.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897189335.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897221436.00007FF716742000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897268595.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff716700000_test.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 1dd0fb9084421c91b65d0b171e4d574246ab6e6d6619506de9fbcb18218c1bc5
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 45017162918A4285FB21BB60987527FA2A1EF4C728FC4003AD55D46695DF3CE54CCE34

Analysis Process: test.exePID: 7400, Parent PID: 7336COMMON

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	51

Executed Functions

Function 00007FF716701000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF716703A17, 00007FF716703A2F, 00007FF716703A9B
Failed to remove temporary directory: %s, xrefs: 00007FF716703FC3
pyi-disable-windowed-traceback, xrefs: 00007FF716703BB2
Failed to load splash screen resources!, xrefs: 00007FF716703E85
_PYI_ARCHIVE_FILE, xrefs: 00007FF7167038D2, 00007FF7167039FF
pkg, xrefs: 00007FF7167039BE
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF716703D12
Py_GIL_DISABLED, xrefs: 00007FF716703AF4
VCRUNTIME140.dll, xrefs: 00007FF716703DB1
MEI, xrefs: 00007FF716703933
pyi-python-flag, xrefs: 00007FF716703AD6
pyi-contents-directory, xrefs: 00007FF716703B8D
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7167039DE
Failed to start splash screen!, xrefs: 00007FF716703ED4
Failed to convert DLL search path!, xrefs: 00007FF716703DDC
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF716703B32
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF716703C61
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF716703EA6
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF716703882, 00007FF7167038AF
Could not create temporary directory!, xrefs: 00007FF716703CBF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF716703971
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF716703EBB
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF716703A0B, 00007FF716703CD4, 00007FF716703F6B
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF716703BE8
_PYI_SPLASH_IPC, xrefs: 00007FF716703A23, 00007FF716703EF5
pyi-runtime-tmpdir, xrefs: 00007FF716703B68
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF716703E0A
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF716703D35

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
Instruction ID: c50545c63dd69791a517a96d1e9afb1c5974ab27aaaa4c0ab6f88a151ca3e123
Opcode Fuzzy Hash: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
Instruction Fuzzy Hash: D3328C61A08E8391FA25BB259C743BBA251AF5E7B4FC44136DA5D422C6EF2CE55CC330

Function 00007FF716725C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF716725CB5

Part of subcall function 00007FF716725608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672561C

Part of subcall function 00007FF71671A9B8: HeapFree.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
Part of subcall function 00007FF71671A9B8: GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

Part of subcall function 00007FF71671A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF71671A94F,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671A979
Part of subcall function 00007FF71671A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF71671A94F,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671A99E

_get_daylight.LIBCMT ref: 00007FF716725CA4

Part of subcall function 00007FF716725668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672567C

_get_daylight.LIBCMT ref: 00007FF716725F1A
_get_daylight.LIBCMT ref: 00007FF716725F2B
_get_daylight.LIBCMT ref: 00007FF716725F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71672617C), ref: 00007FF716725F63

Strings

Eastern Standard Time, xrefs: 00007FF716726009
Eastern Summer Time, xrefs: 00007FF716726021

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction ID: eeccce077fa5dd4c450a14936c9fb0f99f3dccb1ffe5436e136368c338f57a25
Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction Fuzzy Hash: 8DD1C232A08A5246F720BF229C615BBA752EF4C7B4FD0813ADA0E47695DF3CE44D8760

Function 00007FF7167269D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF716726708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716726749
Part of subcall function 00007FF716726708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7167267C7
Part of subcall function 00007FF716726708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716726818

CreateFileW.KERNEL32 ref: 00007FF716726ADA
CreateFileW.KERNEL32 ref: 00007FF716726B2A
GetLastError.KERNEL32 ref: 00007FF716726B5A
GetFileType.KERNEL32 ref: 00007FF716726B6F
GetLastError.KERNEL32 ref: 00007FF716726B79
CloseHandle.KERNEL32 ref: 00007FF716726BAC
CloseHandle.KERNEL32 ref: 00007FF716726D0F
CreateFileW.KERNEL32 ref: 00007FF716726D44
GetLastError.KERNEL32 ref: 00007FF716726D53

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: b892d9b6f7a9a48c52265414bba7c0a0dd2f7508eb98364cb03945893dddfe18
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 2DC1D432B24E5186EB10EF64C8A02AD7762F74DBA8F91422ADE2E577D4CF38D459C310

Function 00007FF716725EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF716725F1A

Part of subcall function 00007FF716725668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672567C

_get_daylight.LIBCMT ref: 00007FF716725F2B

Part of subcall function 00007FF716725608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672561C

_get_daylight.LIBCMT ref: 00007FF716725F3C

Part of subcall function 00007FF716725638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71672564C

Part of subcall function 00007FF71671A9B8: HeapFree.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
Part of subcall function 00007FF71671A9B8: GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71672617C), ref: 00007FF716725F63

Strings

Eastern Standard Time, xrefs: 00007FF716726009
Eastern Summer Time, xrefs: 00007FF716726021

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction ID: cab2d58c9e65ebd30314507a811a7c5ca0cd7c9620af7c4432cf8e02a1315b8c
Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction Fuzzy Hash: CD514332A18A5286E720FF22DCA156BE752FB4C7A4FC4413ADA4D47696DF3CE44C8760

Function 00007FF7167092F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF716709323
FindClose.KERNEL32 ref: 00007FF716709332

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: d3e27e22025f41329e34c933c3bc2eafa4604812b569e43f929f01a679eb1b3e
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: F6F04426A18B4286F760AB60BCA9767E750EB8D778F841235D96D026D4DF3CE04D8A10

Function 00007FF716701950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF716707F80: _fread_nolock.LIBCMT ref: 00007FF71670802A

_fread_nolock.LIBCMT ref: 00007FF716701A1B

Part of subcall function 00007FF716702910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF716701B6A), ref: 00007FF71670295E

Strings

Error on file., xrefs: 00007FF716701B8D
Failed to read cookie!, xrefs: 00007FF716701A2B
calloc, xrefs: 00007FF716701A68
fseek, xrefs: 00007FF7167019F5
malloc, xrefs: 00007FF716701B22
Failed to seek to cookie position!, xrefs: 00007FF7167019EE
Could not read full TOC!, xrefs: 00007FF716701B55
fread, xrefs: 00007FF716701A32, 00007FF716701B5C
Could not allocate memory for archive structure!, xrefs: 00007FF716701A61
Could not allocate buffer for TOC!, xrefs: 00007FF716701B1B
MEI, xrefs: 00007FF716701991

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
Instruction ID: e47e3a87c894850033a2b92db58620e8f29929f413eed35b8815390981aec7bb
Opcode Fuzzy Hash: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
Instruction Fuzzy Hash: 9E819071A08E8285E720FB64EC602BBA3A1EB4D755F844536E98D43785DF3CE58D8770

Function 00007FF716702180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 00007FF7167021AB
SelectObject.GDI32 ref: 00007FF7167021F2
DrawTextW.USER32 ref: 00007FF716702215
SelectObject.GDI32 ref: 00007FF71670222B
ReleaseDC.USER32 ref: 00007FF71670223B
MoveWindow.USER32 ref: 00007FF71670228B
MoveWindow.USER32 ref: 00007FF7167022CB
MoveWindow.USER32 ref: 00007FF71670231E
MoveWindow.USER32 ref: 00007FF716702366

Strings

P%, xrefs: 00007FF7167021FF

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: ade0606709fd40a6a902563c40cd238d7e4b99d77ea7d0ef8b600ced5211661b
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: FB51F626614BA186D634AF22A8581BBB7A1F79CB65F004125EFDE43694DF3CD049CB20

Function 00007FF716701470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7167015DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF716701518
Failed to extract %s: failed to open archive file!, xrefs: 00007FF71670149F
fseek, xrefs: 00007FF7167014E5
malloc, xrefs: 00007FF71670151F
fread, xrefs: 00007FF7167015E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7167014DE

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 3899eae9b9cf556598d50536af751799a91292f9e5d7650659be9fe1a68b4b95
Instruction ID: ac0e70a48790b556d9c67cec0dda28d7cfb4f1351f3041d67ec0683abfe498b1
Opcode Fuzzy Hash: 3899eae9b9cf556598d50536af751799a91292f9e5d7650659be9fe1a68b4b95
Instruction Fuzzy Hash: 5F418126B08A4285EA00FB61AC601B7E390FF4D7A8FC44436ED5D07B99DE3CE54D8760

Function 00007FF716701210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7167012BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF71670141E
malloc, xrefs: 00007FF7167012C1, 00007FF7167012F6
1.3.1, xrefs: 00007FF716701249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF716701276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7167012EF

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5578c14fe94a244900e9a575e4f77a257a8de495ed559fdf9b362ebbbffb2fa7
Instruction ID: 697e7fca25b16e91c7e380fecd4e09e8072b5dd4b95371e43fc2d14b5493a906
Opcode Fuzzy Hash: 5578c14fe94a244900e9a575e4f77a257a8de495ed559fdf9b362ebbbffb2fa7
Instruction Fuzzy Hash: B551B162A08A4241E660BB51AC603BBE291FB8EBA8FC44135ED4D47795EF3CE54DC720

Function 00007FF7167036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF716703804), ref: 00007FF7167036E1
GetLastError.KERNEL32(?,00007FF716703804), ref: 00007FF7167036EB

Part of subcall function 00007FF716702C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702C9E
Part of subcall function 00007FF716702C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D63
Part of subcall function 00007FF716702C50: MessageBoxW.USER32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D99

Strings

\\?\, xrefs: 00007FF71670375A
GetModuleFileNameW, xrefs: 00007FF7167036FA
Failed to convert executable path to UTF-8., xrefs: 00007FF716703790
Failed to obtain executable path., xrefs: 00007FF7167036F3
Failed to resolve full path to executable %ls., xrefs: 00007FF716703739

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: ea6b0847aa7cc2419e831e488f02ee8773f974b0fccf99a48144e7d9a28f7ad6
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: C5216D61B18E4381FA60B720EC613B7A251BF9E774FC05136E56D826D6EE2CE50C8770

Function 00007FF71671BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671BEF9

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction ID: e5990355003ea47aa8678b3176bd6bf55337f3e96eb649a8ee08f8b82a365da0
Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction Fuzzy Hash: 45C108A290CE8681E720AB1598602BFB764FB89FA0FD54136EA5D03795CF7CE54D8720

Function 00007FF716706350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ucrtbase.dll, xrefs: 00007FF7167063CD
Failed to load Python DLL '%ls'., xrefs: 00007FF716706497
LoadLibrary, xrefs: 00007FF71670649E
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7167063B7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF716706446
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7167063F7

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: fd36a0f3c4505a6755a59b77667fc507f4e509fb877e1af8c0628fd85e3d3567
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: DD415D21A18E86A1EA11FB60EC742EBA311FB59364FD00132EA5D43695EF3CE64DC770

Function 00007FF716702390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7167023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF71670248E
DeleteObject.GDI32 ref: 00007FF7167024C1
DestroyIcon.USER32 ref: 00007FF7167024D3

Strings

Unhandled exception in script, xrefs: 00007FF7167023F8

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction ID: 8fba3d429930fccf4cc57a87ec7850e97f3857fb4ff614e2b72586677bc8bf04
Opcode Fuzzy Hash: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction Fuzzy Hash: 14315072619A8189EB20BF21EC652FAA360FF8D798F940135EA4D47B59DF3CD14C8720

Function 00007FF71671F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF71671FAEC
_get_daylight.LIBCMT ref: 00007FF71671FAFD
_get_daylight.LIBCMT ref: 00007FF71671FB0E
_isindst.LIBCMT ref: 00007FF71671FBD9

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 3ecbe8114eb67ebe3b10bd514a3515ef1dd1e04d8207934ba43a7029b5411b1e
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 40510BB2F0891186FB24EF389D716BDA7E1AB18378F910136DD1E52AE5DB3CA44D8710

Function 00007FF7167157EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF71671581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF716715881
GetLastError.KERNEL32 ref: 00007FF716715912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF716715724), ref: 00007FF71671595E

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 1b5e07b5b398da429095c78699f3cbd7dcb7c2f6aef57cef4dbb6a210240c813
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 8051B2E2E14A418AFB14EF71D8603BEA3A5FB48B68F584436DE0D57689DF38D44C8721

Function 00007FF716715698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167156C5
CreateFileW.KERNEL32 ref: 00007FF716715704
CloseHandle.KERNEL32 ref: 00007FF716715739

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction ID: b30f8ac1ba44c428d4ca140d455de6c3cd77f4a1d1d7cb64d0e96e14d217f70c
Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction Fuzzy Hash: 3041D9A2D18B8183F314AB20996137AA360FB98774F548336E65C03AD1DF7CA5EC8760

Function 00007FF7167020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7167020F4
SetWindowLongPtrW.USER32 ref: 00007FF716702116
GetWindowLongPtrW.USER32 ref: 00007FF716702140
InvalidateRect.USER32 ref: 00007FF716702160

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: f560160375906010e84032e048ac135db81479a89c703f8fc38da08b41d866b9
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: DB11E932B1C94242F654B769ED9427B9292EF8DBA4FC4C030DB5907B89CD3DE48D8230

Function 00007FF71670CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71670CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71670CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71670CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF71670CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF71670CD91

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: e1dc6125a54463fd03684d86fdcfd65195af9a56f7ac1127a4604da339cabd76
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 6E314721E48E0341FA24BB649C723BBA782AF4A7A8FD44435D90D4B2D7DE2CA44DC271

Function 00007FF7167101AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167101F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167102E7

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 54eae8b4cd0c1a73e58d81b1fa6bd815b1cc54da5eeeefe951fd4b79ecc9bea9
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 1151C7A1B09A4146EA26BA359C2067BE291BF4CBB4F944736EE6C477C5CF3CD44DC620

Function 00007FF71671C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF71671C33D), ref: 00007FF71671C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF71671C33D), ref: 00007FF71671C1FA

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: ec7ff3ac686da093c1522ff3d4d6ad6d4e8d1e0d4108f1b0e014117b4e8d2e23
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: E511C4A1718E4181DA10AB65AC2417AA361FB49BF4F944332EE7D4B7D9CF7CD01D8700

Function 00007FF716715994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7167158A9), ref: 00007FF7167159C7
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7167158A9), ref: 00007FF7167159DD

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction ID: 00c7ee29b0ea046034a1f514507933e2a8396b804e43b746d8e2ab3ce725b98f
Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction Fuzzy Hash: 571194B261CA1282FA546B14A86113BF760FB88771F900236F69D419D8EF3CD05CCB20

Function 00007FF71671ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF71671AA45,?,?,00000000,00007FF71671AAFA), ref: 00007FF71671AC36
GetLastError.KERNEL32(?,?,?,00007FF71671AA45,?,?,00000000,00007FF71671AAFA), ref: 00007FF71671AC40

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 84009b94f8943afb3bfb307c4162a3d8321c96e489dd1ba43eb0ae390bf472b5
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 13216561B1CE4242EAA477619C7527B92C29F9C7B4F884237DD2E473D5CE6CA44D8310

Function 00007FF71671A9B8 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 14cd26a99e5f55e9baa4bf979cf7b734dadf526da71620df8649b61fd0db2a69
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 44E04F91E09A0342FF14BBB25C7513A9291AF8CB61FC50035D81D422A2DE2C688D8620

Function 00007FF71671BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671BF44

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: 5d48cf34536a668f5467f58eae7138b63d299794641a2128cf48a08d91e130f1
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 68411DB2918A0147EA34BB15AD6017BF3A4EB5DB60F900133DA9D436D1CF2DE40ECB60

Function 00007FF716707F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF71670802A

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: e030e723ccfde11af85d0dda47479fa887e00b1a31505a58a3447353ba43a7bb
Instruction ID: 0d7e03befb6bcc61f1d83fd356ccb62ddde6a9ad96167c932536fcc12e82ca78
Opcode Fuzzy Hash: e030e723ccfde11af85d0dda47479fa887e00b1a31505a58a3447353ba43a7bb
Instruction Fuzzy Hash: 62218021B1DA9285EE10BA226D243BBD651BF4ABE4FCD5431EE4D07786CE3DE04DC620

Function 00007FF71671B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671BA32

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 1c90275a2246e46690b0003f37790a97333f98431cb5a96ab8160f87d9bc8b6e
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: 1C318BA1A18A4286E7517B558C6127EA664AB48FB4FD60136EA2D073D2CF7CA44D8730

Function 00007FF716716004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716715F69

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: bcc62871db6ab0e75e888d3455619fcec663d8d6fcad2caea3db266cf6869af4
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 401165A2A18A4141FA647F11982017FE2A8BF49BA0FC84032FB5C57795DF3DD54C8B20

Function 00007FF7167263C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167263E7

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 2b069f39fa3a3d27441ed7fd246a2db8f794d3c236129da6408c6ce543c04580
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: E721CC72618E4147DB61AF28D86037AB6A1FB88B74F944239EB9D476D5DF3CD40C8B10

Function 00007FF71671042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716710480

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 7994d96825c36c208c21f7175deb8c2f1602f3dd014b3bdca12676abadbd8adc
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: CA01A5A1B08B4140E905FF529D1106AE695BF9AFF0F8C4632EE5C17BDACE3CD0198310

Function 00007FF716709070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF716709400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7167045E4,00000000,00007FF716701985), ref: 00007FF716709439

LoadLibraryExW.KERNEL32(?,00007FF716706466,?,00007FF71670336E), ref: 00007FF716709092

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction ID: 2f7672e78bf7ebca9005f032650a8dc1b530384c870830cbfeb7fd86279abb58
Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction Fuzzy Hash: A0D08C11B24A8541EA94B767BE5663A9252ABCDFD4E989035EE1D03B4ADC3CC0494B00

Function 00007FF71671D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF716710D00,?,?,?,00007FF71671236A,?,?,?,?,?,00007FF716713B59), ref: 00007FF71671D6AA

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: c742166b22e4176d568eb6ba419f1a0d18a70e52a56f47ef0a1c12ca51f6efa3
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 98F03A92B09B0A45FE5476715C61276A2909F5CBF0F880232982E453C2EE2CA54C8930

Non-executed Functions

Function 00007FF716708BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF716709400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7167045E4,00000000,00007FF716701985), ref: 00007FF716709439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708C46

Part of subcall function 00007FF71671A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71671A500

Part of subcall function 00007FF71671878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7167187F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708CD6
CreateProcessW.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708D18

Part of subcall function 00007FF716702C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702C9E
Part of subcall function 00007FF716702C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D63
Part of subcall function 00007FF716702C50: MessageBoxW.USER32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D99

RegisterClassW.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708D7B
CreateWindowExW.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E05
PeekMessageW.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E29
TranslateMessage.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E41
PeekMessageW.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716708FF4
GetExitCodeProcess.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716709009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF716709012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF716703F7F), ref: 00007FF71670901F

Strings

Failed to create child process!, xrefs: 00007FF716708D20
CreateProcessW, xrefs: 00007FF716708D27
PyInstaller Onefile Hidden Window, xrefs: 00007FF716708D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF716708D44

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: a26c13260e8690a1f107172321a1eca8371806eeff93485115b50203827f3ae4
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 68D16631A08E4286EB10AF74EC642BBB765FB89B68F900235DA5D43695DF3CE54DC720

Function 00007FF7167083B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF71670841B
RemoveDirectoryW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF71670849E
DeleteFileW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084BD
FindNextFileW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084CB
FindClose.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084DC
RemoveDirectoryW.KERNEL32(?,00007FF716708B09,00007FF716703FA5), ref: 00007FF7167084E5

Strings

%s\*, xrefs: 00007FF7167083E2

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: da10b20d8122475c7c25776bfc12ddf93457d5ff052d52d4fe8d705e1b4174e4
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: F5417121A0CD4295EE20BF24EC641BBA364FB99764FC10236E99D42684DF3CE54D8720

Function 00007FF71670D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF71670D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF71670D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71670D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF71670D240
IsDebuggerPresent.KERNEL32 ref: 00007FF71670D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71670D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71670D2BC

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 089968030c76bc1ff7d2f57d1ba8c9303b82550cc9ada657a64990e42ce8504e
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: D5310D72608F8185EB60EF60EC903AEA3A5FB89758F444439DA4D46A94DF38D54C8720

Function 00007FF71671A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF71671A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71671A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF71671A750
IsDebuggerPresent.KERNEL32 ref: 00007FF71671A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71671A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71671A79E

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: de361c8913b9271ed45663c42412d1d03309e316d0ccfab33e2f7a5a95f25370
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 2C314176618F8185D760EB25EC502AFB3A5FB89768F94013AEA8D43B58DF38D14D8B10

Function 00007FF7167218E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716721930
FindFirstFileExW.KERNEL32 ref: 00007FF716721A3A

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction ID: 2caae054d9db6abd9433848c0e6bcc4b17899a0a2ac82cb9e01b0ada408d2793
Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction Fuzzy Hash: C7B1A959B18A9241EA61AB21AC205BBE362FB4CBF5F845136DF4D07B85DE3CE44DC710

Function 00007FF716705820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705830
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705842
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705879
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670588B
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058A4
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058B6
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058CF
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058E1
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167058FD
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670590F
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670592B
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670593D
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705959
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF71670596B
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705987
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF716705999
GetProcAddress.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167059B5
GetLastError.KERNEL32(?,00007FF7167064BF,?,00007FF71670336E), ref: 00007FF7167059C7

Strings

PyConfig_InitIsolatedConfig, xrefs: 00007FF7167059AB, 00007FF7167059CD
PyConfig_SetString, xrefs: 00007FF716705A35, 00007FF716705A57
Py_DecodeLocale, xrefs: 00007FF71670586F, 00007FF716705891
PyObject_CallFunction, xrefs: 00007FF716705CE7, 00007FF716705D09
PyErr_Clear, xrefs: 00007FF716705A91, 00007FF716705AB3
PyErr_Fetch, xrefs: 00007FF716705ABF, 00007FF716705AE1
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF716705DCD, 00007FF716705DEF
PyStatus_Exception, xrefs: 00007FF716705E29, 00007FF716705E4B
PyModule_GetDict, xrefs: 00007FF716705CB9, 00007FF716705CDB
Py_PreInitialize, xrefs: 00007FF71670594F, 00007FF716705971
PyUnicode_Join, xrefs: 00007FF716705F99, 00007FF716705FBB
PyUnicode_FromFormat, xrefs: 00007FF716705F3D, 00007FF716705F5F
PyRun_SimpleStringFlags, xrefs: 00007FF716705DFB, 00007FF716705E1D
PyConfig_Read, xrefs: 00007FF7167059D9, 00007FF7167059FB
PyObject_SetAttrString, xrefs: 00007FF716705D71, 00007FF716705D93
PyObject_Str, xrefs: 00007FF716705D9F, 00007FF716705DC1
Py_InitializeFromConfig, xrefs: 00007FF7167058F3, 00007FF716705915
PyObject_GetAttrString, xrefs: 00007FF716705D43, 00007FF716705D65
PyMem_RawFree, xrefs: 00007FF716705C8B, 00007FF716705CAD
PyImport_ExecCodeModule, xrefs: 00007FF716705C01, 00007FF716705C23
Py_Finalize, xrefs: 00007FF7167058C5, 00007FF7167058E7
PyConfig_SetBytesString, xrefs: 00007FF716705A07, 00007FF716705A29
GetProcAddress, xrefs: 00007FF716705858
PyErr_Occurred, xrefs: 00007FF716705B1B, 00007FF716705B3D
PySys_SetObject, xrefs: 00007FF716705E85, 00007FF716705EA7
PyUnicode_AsUTF8, xrefs: 00007FF716705EB3, 00007FF716705ED5
PyConfig_Clear, xrefs: 00007FF71670597D, 00007FF71670599F
PyErr_Restore, xrefs: 00007FF716705B77, 00007FF716705B99
PyEval_EvalCode, xrefs: 00007FF716705BA5, 00007FF716705BC7
Py_ExitStatusException, xrefs: 00007FF71670589A, 00007FF7167058BC
Py_DecRef, xrefs: 00007FF716705826, 00007FF716705848
PyUnicode_Replace, xrefs: 00007FF716705FC7, 00007FF716705FE9
PyObject_CallFunctionObjArgs, xrefs: 00007FF716705D15, 00007FF716705D37
PyImport_AddModule, xrefs: 00007FF716705BD3, 00007FF716705BF5
PyMarshal_ReadObjectFromString, xrefs: 00007FF716705C5D, 00007FF716705C7F
PyUnicode_DecodeFSDefault, xrefs: 00007FF716705F0F, 00007FF716705F31
PyErr_Print, xrefs: 00007FF716705B49, 00007FF716705B6B
PyConfig_SetWideStringList, xrefs: 00007FF716705A63, 00007FF716705A85
Failed to get address for %hs, xrefs: 00007FF716705851
PyUnicode_Decode, xrefs: 00007FF716705EE1, 00007FF716705F03
PySys_GetObject, xrefs: 00007FF716705E57, 00007FF716705E79
Py_IsInitialized, xrefs: 00007FF716705921, 00007FF716705943
PyErr_NormalizeException, xrefs: 00007FF716705AED, 00007FF716705B0F
PyImport_ImportModule, xrefs: 00007FF716705C2F, 00007FF716705C51
PyUnicode_FromString, xrefs: 00007FF716705F6B, 00007FF716705F8D

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 3436543a43fb2ccc36599d98619d80e594eb4bf1e0d5ec4b303503bc178f0785
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: A122B424A19F0781FA55BB94AE74576A3A2EF1DB79FD45039C81E023A0EF7CB14C8270

Function 00007FF7167076B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7167076C7
GetLastError.KERNEL32 ref: 00007FF7167076D9
GetProcAddress.KERNEL32 ref: 00007FF716707715
GetLastError.KERNEL32 ref: 00007FF716707727
GetProcAddress.KERNEL32 ref: 00007FF716707740
GetLastError.KERNEL32 ref: 00007FF716707752
GetProcAddress.KERNEL32 ref: 00007FF71670776B
GetLastError.KERNEL32 ref: 00007FF71670777D
GetProcAddress.KERNEL32 ref: 00007FF716707799
GetLastError.KERNEL32 ref: 00007FF7167077AB
GetProcAddress.KERNEL32 ref: 00007FF7167077C7
GetLastError.KERNEL32 ref: 00007FF7167077D9
GetProcAddress.KERNEL32 ref: 00007FF7167077F5
GetLastError.KERNEL32 ref: 00007FF716707807
GetProcAddress.KERNEL32 ref: 00007FF716707823
GetLastError.KERNEL32 ref: 00007FF716707835
GetProcAddress.KERNEL32 ref: 00007FF716707851
GetLastError.KERNEL32 ref: 00007FF716707863

Strings

Tcl_Init, xrefs: 00007FF7167076C0, 00007FF7167076DF
Tcl_CreateInterp, xrefs: 00007FF71670770B, 00007FF71670772D
Tcl_ConditionFinalize, xrefs: 00007FF71670792D, 00007FF71670794F
Tcl_Alloc, xrefs: 00007FF716707C0D, 00007FF716707C2F
Tcl_DeleteInterp, xrefs: 00007FF7167077EB, 00007FF71670780D
Tcl_MutexLock, xrefs: 00007FF7167078A3, 00007FF7167078C5
Tcl_GetCurrentThread, xrefs: 00007FF716707847, 00007FF716707869
Tcl_GetString, xrefs: 00007FF716707A9D, 00007FF716707ABF
Tcl_Free, xrefs: 00007FF716707C3B, 00007FF716707C5D
Tcl_GetVar2, xrefs: 00007FF716707A13, 00007FF716707A35
Tcl_FinalizeThread, xrefs: 00007FF7167077BD, 00007FF7167077DF
Tcl_ThreadAlert, xrefs: 00007FF7167079E5, 00007FF716707A07
Tcl_JoinThread, xrefs: 00007FF716707875, 00007FF716707897
Tcl_SetVar2Ex, xrefs: 00007FF716707B27, 00007FF716707B49
Tcl_ConditionWait, xrefs: 00007FF716707989, 00007FF7167079AB
Tcl_NewByteArrayObj, xrefs: 00007FF716707AF9, 00007FF716707B1B
GetProcAddress, xrefs: 00007FF7167076EF
Tcl_MutexFinalize, xrefs: 00007FF7167078FF, 00007FF716707921
Tcl_CreateThread, xrefs: 00007FF716707819, 00007FF71670783B
Tcl_DoOneEvent, xrefs: 00007FF716707761, 00007FF716707783
Tcl_ConditionNotify, xrefs: 00007FF71670795B, 00007FF71670797D
Tk_Init, xrefs: 00007FF716707C69, 00007FF716707C8B
Tk_GetNumMainWindows, xrefs: 00007FF716707C97, 00007FF716707CB9
Tcl_FindExecutable, xrefs: 00007FF716707736, 00007FF716707758
Tcl_GetObjResult, xrefs: 00007FF716707B55, 00007FF716707B77
Tcl_MutexUnlock, xrefs: 00007FF7167078D1, 00007FF7167078F3
Tcl_SetVar2, xrefs: 00007FF716707A41, 00007FF716707A63
Tcl_ThreadQueueEvent, xrefs: 00007FF7167079B7, 00007FF7167079D9
Tcl_NewStringObj, xrefs: 00007FF716707ACB, 00007FF716707AED
Tcl_Finalize, xrefs: 00007FF71670778F, 00007FF7167077B1
Failed to get address for %hs, xrefs: 00007FF7167076E8
Tcl_CreateObjCommand, xrefs: 00007FF716707A6F, 00007FF716707A91
Tcl_EvalObjv, xrefs: 00007FF716707BDF, 00007FF716707C01
Tcl_EvalFile, xrefs: 00007FF716707B83, 00007FF716707BA5
Tcl_EvalEx, xrefs: 00007FF716707BB1, 00007FF716707BD3

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: bea7286a7ae161293756abb8cc1dc15c91457cd2728c3f0e5d728c7a1608a662
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: FD02A321A1EF0791EA15BB55AD745B6E3A2EF1DB79FD41039D81E022A0EF3CB54D8230

Function 00007FF7167081C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF716709400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7167045E4,00000000,00007FF716701985), ref: 00007FF716709439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7167088A7,?,?,00000000,00007FF716703CBB), ref: 00007FF71670821C

Part of subcall function 00007FF716702810: MessageBoxW.USER32(?,?,?,?,?,00007FF71670379C), ref: 00007FF7167028EA

Strings

CreateDirectory, xrefs: 00007FF71670836C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF71670828D
\, xrefs: 00007FF716708251
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF716708363
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7167082C9
%.*s, xrefs: 00007FF7167082FC
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7167081F3
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF716708230

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction ID: e5ebef0a2cb08dfe76a06f297fda623f67086e7d319359f7a169c0b04650ee3a
Opcode Fuzzy Hash: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction Fuzzy Hash: 49517122A18E4281EB50FB21EC716BBE251EF9D7A0FD44435D90E866D5EE2CE50C8770

Function 00007FF716701600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open target file!, xrefs: 00007FF71670165C
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7167017DF
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF716701742
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7167017CA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7167016A2
fseek, xrefs: 00007FF7167016E1
malloc, xrefs: 00007FF716701749
fopen, xrefs: 00007FF716701663
fread, xrefs: 00007FF7167017E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7167016DA
Failed to create symbolic link %s!, xrefs: 00007FF716701622
fwrite, xrefs: 00007FF7167017D1

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 0a87ee3060ec78e21d6c2d3bfc048a27d307e8fd5641d8a78f43b3b0b6daa239
Instruction ID: a4ace5358b9bea0fd86c1399ecdb2989f4b8b1843b2547bab31030aa2e4e8852
Opcode Fuzzy Hash: 0a87ee3060ec78e21d6c2d3bfc048a27d307e8fd5641d8a78f43b3b0b6daa239
Instruction Fuzzy Hash: 14515B61B08E4782EA10BB51AC201BBA391BF49BB8FC44536EE5C07796DF3CE55D8760

Function 00007FF7167080B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7167080EF
GetWindowLongPtrW.USER32 ref: 00007FF71670816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF716708182
GetLastError.KERNEL32 ref: 00007FF71670818C
SetWindowLongPtrW.USER32 ref: 00007FF7167081A3

Strings

Needs to remove its temporary files., xrefs: 00007FF716708175

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: aea34c27e282c0624d302ef0732ff3d20d6e42cb4d2e121fcb37174a97192862
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: AE21A621B18E4282EB517B7AAC6417AA251FF8DFB4F994235DA2D433D4DF2CD59C8230

Function 00007FF716716300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716716343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716716730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167169CC

Strings

f, xrefs: 00007FF716716465
-, xrefs: 00007FF7167163D9
:, xrefs: 00007FF7167164FC
p, xrefs: 00007FF71671646D
p, xrefs: 00007FF7167163F5

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 4c706a7dd7498be6fafee1df948a81b32cc7753a536156dd8c3f0275407faabf
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 741283A2E0D96386FB207B14D97427BF6A1FB58760FC44137D699466C4DB3CE58C8B20

Function 00007FF716711038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716711078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716711440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167116DF

Strings

f, xrefs: 00007FF7167112C5
f, xrefs: 00007FF71671117A
p, xrefs: 00007FF71671111D
p, xrefs: 00007FF716711182
f, xrefs: 00007FF716711110

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: ff1b0b04904ed9818d8209860e18f5e84427a92b8fcd4a7cec66239927743cb1
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: C51293B1E0C94785FB20BA15F86467BE261FB44765FC84037E6994AAC4DF7DE48C8B20

Function 00007FF716701050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7167011F6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF716701108
Failed to extract %s: failed to open archive file!, xrefs: 00007FF716701098
fseek, xrefs: 00007FF7167010D3
malloc, xrefs: 00007FF71670110F
fread, xrefs: 00007FF7167011FD
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7167010CC

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: e30da66bd449e278f4e1a8a1da43a6fc232ee02027dbecaf9a0becaf305aee32
Instruction ID: 5bada9bf95e6475cc9fdae14d69a8634f50c2d369a8bc188d173cffb5964eae1
Opcode Fuzzy Hash: e30da66bd449e278f4e1a8a1da43a6fc232ee02027dbecaf9a0becaf305aee32
Instruction Fuzzy Hash: 28418E61B08A5282EA04FB51AC206BBE395FF5EBA4FC44432ED5C07785DE3CE14D8760

Function 00007FF716708850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF716703CBB), ref: 00007FF7167088F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF716703CBB), ref: 00007FF7167088FA
CreateDirectoryW.KERNEL32(?,00000000,00007FF716703CBB), ref: 00007FF71670893C

Part of subcall function 00007FF716708A20: GetEnvironmentVariableW.KERNEL32(00007FF71670388E), ref: 00007FF716708A57
Part of subcall function 00007FF716708A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF716708A79

Part of subcall function 00007FF7167182A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7167182C1

Part of subcall function 00007FF716702810: MessageBoxW.USER32(?,?,?,?,?,00007FF71670379C), ref: 00007FF7167028EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF71670896E
TMP, xrefs: 00007FF7167088B2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7167088CC
_MEI%d, xrefs: 00007FF716708902
TMP, xrefs: 00007FF71670888C, 00007FF716708993

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction ID: d8a55d06be04c0b6820d2ceb560a06c01cfff70698beb34f6ec3e60c19130c10
Opcode Fuzzy Hash: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction Fuzzy Hash: 3E41B152A19E4244FA10FB25AC752BB9291AF8EBA4FD55032ED0D477DADE3CE50C8730

Function 00007FF71670EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF71670EAD5

Part of subcall function 00007FF71670FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF71670FA6F
Part of subcall function 00007FF71670FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF71670FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF71670EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF71670EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71670EF08

Strings

csm, xrefs: 00007FF71670EAEF
csm, xrefs: 00007FF71670EBD0
csm, xrefs: 00007FF71670EB56

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 0f6fa424f94d91053cf61cfff396d2ba13e4a1c648d7f6e2d50330bf76628ad0
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 29D16F72908B4186EB20FB25DC603AEA7A0FB4A7A8F500535EE4D57795DF38E58DC720

Function 00007FF71671ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF71671F11A,?,?,000001A60157A728,00007FF71671ADC3,?,?,?,00007FF71671ACBA,?,?,?,00007FF716715FAE), ref: 00007FF71671EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF71671F11A,?,?,000001A60157A728,00007FF71671ADC3,?,?,?,00007FF71671ACBA,?,?,?,00007FF716715FAE), ref: 00007FF71671EF08

Strings

api-ms-, xrefs: 00007FF71671EE46
ext-ms-, xrefs: 00007FF71671EE59

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: d822d982001ad4d534cdc7b653913ce22771d6d6b0e5203dec187c649175903b
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: 6A41D2A1B29E1241FA16EB169C24676A391BF4DBB0FD8493ADD1D57384EF3CE54C8320

Function 00007FF716702C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D63
MessageBoxW.USER32(?,?,?,?,?,?,?,?,00007FF716703706,?,00007FF716703804), ref: 00007FF716702D99

Strings

%ls: , xrefs: 00007FF716702D22
<FormatMessageW failed.>, xrefs: 00007FF716702D70
[PYI-%d:ERROR] , xrefs: 00007FF716702CA6
Error, xrefs: 00007FF716702D8C

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 78248fc368abc303673d8bf1ff02c5260d9c55dba35123e527228ae1bb84a96b
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 9831A773704E4142E620BB15AC602ABA695BF8DBA8F804135DF4D53759DF3CD54EC720

Function 00007FF71670DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DDBD
GetLastError.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DE63
GetProcAddress.KERNEL32(?,?,?,00007FF71670DFEA,?,?,?,00007FF71670DCDC,?,?,?,00007FF71670D8D9), ref: 00007FF71670DE6F

Strings

api-ms-, xrefs: 00007FF71670DDDD

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: e1e42b01de42037910fbefba20b4b971679530161ab25c3e4cf460bea3cedd30
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: 83315022B1AB4291EE12BB12AC2057AE394FF5DBB4F994539DD1D46380EF3CE44C8634

Function 00007FF716702A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF71670351A,?,00000000,00007FF716703F23), ref: 00007FF716702AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF716702AA8
Warning [ANSI Fallback], xrefs: 00007FF716702B0F
0, xrefs: 00007FF716702B16
WARNING, xrefs: 00007FF716702AAF
Warning, xrefs: 00007FF716702B1E

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 6ea6a585244da4c52085459eca779fc4d0c0004916727137f5f5ae08259463e2
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 38217F72A18B8192E620AB51BCA17E7A394FB8C7A4F800136FE8C43659DF3CD14D8750

Function 00007FF716708760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF716708780
OpenProcessToken.ADVAPI32 ref: 00007FF716708793
GetTokenInformation.ADVAPI32 ref: 00007FF7167087B8
GetLastError.KERNEL32 ref: 00007FF7167087C2
GetTokenInformation.ADVAPI32 ref: 00007FF716708802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF71670881E
CloseHandle.KERNEL32 ref: 00007FF716708836

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction ID: 8555396abfa03a269e30c4c153e951f3a21e15fc4f1caf7f6ba17e8e34faec20
Opcode Fuzzy Hash: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction Fuzzy Hash: 7F214421A18E4241EA10BB55FC6423BE3A1EB89BB4F900235E66D437E4DF6CD44C8720

Function 00007FF71671B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF71671B1CF
FlsGetValue.KERNEL32 ref: 00007FF71671B1E4
FlsSetValue.KERNEL32 ref: 00007FF71671B205
FlsSetValue.KERNEL32 ref: 00007FF71671B232
FlsSetValue.KERNEL32 ref: 00007FF71671B243
FlsSetValue.KERNEL32 ref: 00007FF71671B254
SetLastError.KERNEL32 ref: 00007FF71671B26F

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
Instruction ID: c1d193bbe3b73c5404641a4403bd630be2d81b20281281ae0fac3a9e61e3d3d7
Opcode Fuzzy Hash: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
Instruction Fuzzy Hash: D72159A0E0CE0241FA64B7615E7113FD1825F4CBB0F804636D93E46AD6DE2CE44C8320

Function 00007FF716727DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF716727E0D
GetLastError.KERNEL32 ref: 00007FF716727E19
CloseHandle.KERNEL32 ref: 00007FF716727E31
CreateFileW.KERNEL32 ref: 00007FF716727E5C
WriteConsoleW.KERNEL32 ref: 00007FF716727E7B

Strings

CONOUT$, xrefs: 00007FF716727E3D

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 6fcd257559399ea3a1fba6e006344e14f45dff6ea1b452fa62e98ce8ed28dfed
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: D3114221A18E4186E750AB56AC6433AE7A1FB8CFF4F844238E95D877A4DF7CD84C8750

Function 00007FF716708560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF716709216), ref: 00007FF716708592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF7167085E9

Part of subcall function 00007FF716709400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7167045E4,00000000,00007FF716701985), ref: 00007FF716709439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF716708678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF7167086E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF7167086F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF716709216), ref: 00007FF71670870A

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction ID: d63eb840bafcfebbad8625b645733a6b79d05b1b2c8cd6315441541fb4c6c08b
Opcode Fuzzy Hash: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction Fuzzy Hash: AC41C666B19A8241EA30BB11AD606ABA394FB8DBE4F851035DF4C57789DE3CD44DC730

Function 00007FF7167090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF716708760: GetCurrentProcess.KERNEL32 ref: 00007FF716708780
Part of subcall function 00007FF716708760: OpenProcessToken.ADVAPI32 ref: 00007FF716708793
Part of subcall function 00007FF716708760: GetTokenInformation.ADVAPI32 ref: 00007FF7167087B8
Part of subcall function 00007FF716708760: GetLastError.KERNEL32 ref: 00007FF7167087C2
Part of subcall function 00007FF716708760: GetTokenInformation.ADVAPI32 ref: 00007FF716708802
Part of subcall function 00007FF716708760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF71670881E
Part of subcall function 00007FF716708760: CloseHandle.KERNEL32 ref: 00007FF716708836

LocalFree.KERNEL32(?,00007FF716703C55), ref: 00007FF71670916C
LocalFree.KERNEL32(?,00007FF716703C55), ref: 00007FF716709175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF716709142
S-1-3-4, xrefs: 00007FF716709121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF716709183
D:(A;;FA;;;%s), xrefs: 00007FF716709157

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 99c74a4d52315fb42bd55e99e472b995ded13158fd6dd8ac4b851532f6881a15
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: D6213922A08F4281E610BB10ED252EBA265FF8D7A0FD45035EA4D53B96DF3CD84D8770

Function 00007FF71671B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B347
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B37D
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3CC
SetLastError.KERNEL32(?,?,?,00007FF716714F81,?,?,?,?,00007FF71671A4FA,?,?,?,?,00007FF7167171FF), ref: 00007FF71671B3E7

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
Instruction ID: a5b58c8b6e9f3b6f6fc026d3baa23165824ebe5e88658f3896f261de67e45af1
Opcode Fuzzy Hash: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
Instruction Fuzzy Hash: 5A1118A0A0CE4286FA5477355E7113BE1829F5CBB0FC44736E82E466D6DF2CE45E8321

Function 00007FF716702910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF716701B6A), ref: 00007FF71670295E

Strings

%s: %s, xrefs: 00007FF7167029E8
Error [ANSI Fallback], xrefs: 00007FF7167029FF
[PYI-%d:ERROR] , xrefs: 00007FF716702966
Error, xrefs: 00007FF716702A0E

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 77d671f8268e7583f659903bcba1f1797a64d33e7eb3d2f85b4d074fd01bbaf4
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: 4C31B763B18A8152E710B751AC606E7A295BF8D7E4F804136FE8D83755DF3CD54E8620

Function 00007FF716702B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF71670918F,?,00007FF716703C55), ref: 00007FF716702BA0
MessageBoxW.USER32(?,00000000,00000000,FFFFFFFF,00000000,00007FF71670918F,?,00007FF716703C55), ref: 00007FF716702C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF716702BA8
WARNING, xrefs: 00007FF716702BAF
Warning, xrefs: 00007FF716702C1D

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 56b0bf2ce7aea90e8b6708b16d6087e033323ceca105d29d4cd4b7ed78de6855
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 8D21BF72718B4182E610AB14BC907EBA3A5EB8C794F804136EA8D53659DF3CE24DC720

Function 00007FF716702710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF716701B99), ref: 00007FF716702760

Strings

[PYI-%d:%s] , xrefs: 00007FF716702768
ERROR, xrefs: 00007FF71670276F
Error [ANSI Fallback], xrefs: 00007FF7167027CF
Error, xrefs: 00007FF7167027DE

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 98ad92210f71b29199db1ac20b5655f222f1d05a399784ec07c6631b7b8d8aa9
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: F1218172A18B8182E720EB50BC917E7A394EB8C7A4F800136FE8C43659DF7CD14D8760

Function 00007FF716719AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF716719B1D
GetProcAddress.KERNEL32 ref: 00007FF716719B33
FreeLibrary.KERNEL32 ref: 00007FF716719B5A

Strings

mscoree.dll, xrefs: 00007FF716719B14
CorExitProcess, xrefs: 00007FF716719B2C

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 7de3022525665aa5f3e208cc058122673767c9683a112a3687016bc0a5826c8a
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 2BF04F61A19E0691FA20AB24ACA537B9321EF4DB75F940239C66E465E4DF2CE48DC360

Function 00007FF7167293D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF716729400
_set_statfp.LIBCMT ref: 00007FF71672941B
_set_statfp.LIBCMT ref: 00007FF716729437
_set_statfp.LIBCMT ref: 00007FF716729473

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 404f75141a7452899725cbdc86dd2bd3fd3738c4ccf1ffa57d9eabcfb7e33c0d
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: E5118F62E5CE1341F6543126DC76377A046EF5D3F4E8C063CEA7E062D68E2CA94D4124

Function 00007FF71671B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B41F
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B43E
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B466
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B477
FlsSetValue.KERNEL32(?,?,?,00007FF71671A613,?,?,00000000,00007FF71671A8AE,?,?,?,?,?,00007FF71671A83A), ref: 00007FF71671B488

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction ID: 08b0404f650ad8fdc6ec91a533ca726000f91c5c402714747874d7350874ea0e
Opcode Fuzzy Hash: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction Fuzzy Hash: 781129A0A18E4241FA58B7255E7117BE1825F9CBB0F888737ED3E466D6DE2CE44D8220

Function 00007FF71671B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF71671B2A5
FlsSetValue.KERNEL32 ref: 00007FF71671B2C4
FlsSetValue.KERNEL32 ref: 00007FF71671B2EC
FlsSetValue.KERNEL32 ref: 00007FF71671B2FD
FlsSetValue.KERNEL32 ref: 00007FF71671B30E

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
Instruction ID: 0e0e4b4598a5b696b851bcd66be88b7d9a5da50fadafd6a68d78e93fb29d7166
Opcode Fuzzy Hash: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
Instruction Fuzzy Hash: 931106A0A18E0646F958B3354C7117BD1824F5D730FC44B37D93E4A2D2DE2CF44E5221

Function 00007FF716716010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716716176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671622C

Strings

verbose, xrefs: 00007FF716716020

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 5db0d2eb34ca3e6bbf177a1c467ae4fd62c45c0e26a2522f32c69f2c4abed661
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: DD91AFB2A08E6681E761AF24DC6077EB2A5AB48BA4FC44137DA5D433D5DF3CE44D8321

Function 00007FF71671FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71671FF17

Part of subcall function 00007FF716717AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716717AC9

Strings

UTF-8, xrefs: 00007FF71671FE96
ccs, xrefs: 00007FF71671FE52
UTF-16LEUNICODE, xrefs: 00007FF71671FEB5

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: fa24f7c794279cf06141c2ac47d8456dffe4ec6647f0c2b17e46be19c2cc2283
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 9B81FBF1E0CE4285F7646F2D893023BB7E0AB29764FE54037C94947289DB2DE50D9721

Function 00007FF71670D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71670D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF71670D77A
RtlUnwindEx.KERNEL32 ref: 00007FF71670D7D4

Strings

csm, xrefs: 00007FF71670D761

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 7d50d14651083d5245bf4d36752daf065943a455d6b2002d27b958d4c6e6189f
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 1C51A233A19B028ADB14FB15DC6467EB791EB49BA8F945134DA4E43784DF3CE849C720

Function 00007FF71670EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF71670EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF71670EFF3

Strings

MOC, xrefs: 00007FF71670EFBB
RCC, xrefs: 00007FF71670EFC3

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 34f8f237ec834366318ef66088819a5028571243bf79ce6f66b0194223f06588
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: CA618172908BC581D760EB15EC503AAB7A0FB89BA4F444225EF9C07B55DF7CD198CB20

Function 00007FF71670F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71670F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF71670F408

Strings

csm, xrefs: 00007FF71670F45A
csm, xrefs: 00007FF71670F342

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 707ba565ec8244538f68b976111ac3986c5930dcdb0f55ebf3ae910e7f1cff4c
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 8451C532508B4286EB74BE299D6436AB690FB5ABA4F944135EE4C43785CF3CE49CC721

Function 00007FF716707E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF71670352C,?,00000000,00007FF716703F23), ref: 00007FF716707F22

Strings

\, xrefs: 00007FF716707E87
%.*s, xrefs: 00007FF716707EDB
%s%c, xrefs: 00007FF716707E94

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction ID: dea5989b1a452373019d2717daa4ce8ef6ab6aaf14aedc9999b5fa8f788a5f06
Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction Fuzzy Hash: 15317521619EC145EA21BB21AC607FBE354EB89BF4F841231EA6D477C9DE3CD64D8720

Function 00007FF716702810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,?,?,?,?,00007FF71670379C), ref: 00007FF7167028EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF716702868
ERROR, xrefs: 00007FF71670286F
Error, xrefs: 00007FF7167028DD

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 6866c0ec36ffe8b1e66e1a361c8d7f1548e954d5eae0c870d709db9cf9688bfe
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: D5219C72B18B4182E610AB54BC947EBA3A5EB8C794F804136EA8D53659DF3CE24DC720

Function 00007FF71671C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF71671C68F
WriteFile.KERNEL32 ref: 00007FF71671C957
WriteFile.KERNEL32 ref: 00007FF71671C99D
GetLastError.KERNEL32 ref: 00007FF71671CA53

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 4b06dd4dac768b06849eaafdeca527620ae9f0f7bc7214b0174c042cb180d858
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 7ED126B2B18A408AE711DFA5D8502AD7771FB487A8B848236CE5D57B89DE3CD01EC750

Function 00007FF71671CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71671CFBB), ref: 00007FF71671D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71671CFBB), ref: 00007FF71671D177

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 53dc846ddf2e997a6f05c34aacaea0f86a8843df5bcaecb50d2e0561f182ed96
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 2291C8B3F18A5145F750FF659C6027EABA0AB48BA8F94413ADE0D53685DE3CD44DCB20

Function 00007FF71670D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF71670D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF71670D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF71670D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF71670D0D6

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 0138b2fdf2c950d4c8a0ebe0085680264c38521c83aa46736ea555ed98c21f35
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 61111C26B14F058AEB00DB60EC652BA73A4FB1DB68F840E35DA6D867A4DF78D15C8350

Function 00007FF716725B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7167217D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716721803

_get_daylight.LIBCMT ref: 00007FF716725CA4
_get_daylight.LIBCMT ref: 00007FF716725CB5

Strings

?, xrefs: 00007FF716725C35

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction ID: 7ab6cae60b8b882024e75ae6ab7c365556f05004dd8163edb7793db969b5f8ea
Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction Fuzzy Hash: E1414C12A08A8242F724A725D86137BD651EB88FB4F944239EE5D06AD5EF3CD48DC710

Function 00007FF716719084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167190B6

Part of subcall function 00007FF71671A9B8: HeapFree.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9CE
Part of subcall function 00007FF71671A9B8: GetLastError.KERNEL32(?,?,?,00007FF716722D92,?,?,?,00007FF716722DCF,?,?,00000000,00007FF716723295,?,?,?,00007FF7167231C7), ref: 00007FF71671A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF71670CC15), ref: 00007FF7167190D4

Strings

C:\Users\user\Desktop\test.exe, xrefs: 00007FF7167190C2

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\test.exe
API String ID: 3580290477-580434538
Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction ID: 9d511bf25b5e70320a7fbaef502707723e17ea35c907996b6c0129a8b399bc5d
Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction Fuzzy Hash: 6C418271A08F4286E715BF259C610BEA794EB4C7E0BD54036EA4D47B85DE3DE58E8320

Function 00007FF71671CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF71671CDBF
GetLastError.KERNEL32 ref: 00007FF71671CDE1

Strings

U, xrefs: 00007FF71671CD6B

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: bbc9a43fb8501ca036f2436a7dbeaa02c02a3743b2ffae6075dd2be46d7c03bd
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: 3641C772B18A4181DB20AF65E8543BAA761FB8C7A4F944036EE8D87798DF3CD409C760

Function 00007FF71671F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF71671F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF71671F6BA

Strings

:, xrefs: 00007FF71671F67E

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction ID: f0c5dcdf64fd39a4ddc791664c5a7586e9f689180a03a1b9ce2ae7008c850c2c
Opcode Fuzzy Hash: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction Fuzzy Hash: BC21F962608A4181EB20AB15D86426FA3F1FB9CB54FD54036D64C43694DF7CD54D8B60

Function 00007FF71670FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF71670FE08
RaiseException.KERNEL32 ref: 00007FF71670FE49

Strings

csm, xrefs: 00007FF71670FE36

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: cec4f2ed7c556955b2bb65d1e527b0f0f83627fece8ba17d51a7d6520fddc0ee
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: C2114C32608F8182EB609B19F85026AB7E1FB88B98F984234DF8D07759DF3CD5598B10

Function 00007FF7167207AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7167207DC
GetDriveTypeW.KERNEL32 ref: 00007FF71672081C

Strings

:, xrefs: 00007FF716720805

Memory Dump Source

Source File: 00000001.00000002.2903530738.00007FF716701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716700000, based on PE: true

Associated: 00000001.00000002.2903515062.00007FF716700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903553404.00007FF71672B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF71673E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903571700.00007FF716741000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2903641305.00007FF716744000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716700000_test.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 1dd0fb9084421c91b65d0b171e4d574246ab6e6d6619506de9fbcb18218c1bc5
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 45017162918A4285FB21BB60987527FA2A1EF4C728FC4003AD55D46695DF3CE54CCE34

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report test.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imaging.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingcms.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingmath.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_imagingtk.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\PIL\_webp.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI73362\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI73362\_asyncio.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_cffi_backend.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_multiprocessing.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_overlapped.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI73362\api-ms-win-core-debug-l1-1-0.dll

Windows Analysis Report
test.exe

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\init.py

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\data\init.py

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\gapi\init.py

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\mat_wrapper\init.py

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\misc\init.py

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\typing\init.py

C:\Users\user\AppData\Local\Temp\_MEI73362\cv2\utils\init.py